#include <gmlib/number/mont256.h>
#include <gmlib/number/uint256.h>

#include <stdexcept>
#include <cstring>

using namespace number;

static std::uint8_t  P_data[32]      = {0xff,0xff,0xff,0xfe,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff};
static std::uint8_t  P_SUB2_data[32] = {0xff,0xff,0xff,0xfe,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfd};
static std::uint8_t  R_data[32]      = {0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01};
static std::uint8_t  R_POW2_data[32] = {0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x02,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x03};
static std::uint8_t  N_data[32]      = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01};

void test_mont256_sub()
{
    uint256_t P, P_SUB2, R, R_POW2, N_;
    uint256_from_bytes(P, P_data);
    uint256_from_bytes(P_SUB2, P_SUB2_data);
    uint256_from_bytes(R, R_data);
    uint256_from_bytes(R_POW2, R_POW2_data);
    uint256_from_bytes(N_, N_data);

    Mont256CTX ctx;
    ctx.P = P, ctx.P_SUB2 = P_SUB2;
    ctx.R = R, ctx.R_POW2 = R_POW2;
    ctx.N_ = N_;

    mont256_t    minuend, subtrahend, difference;
    std::uint8_t difference_data[32];

    std::uint8_t minuend0[32]       = {0xd2,0x3f,0x08,0x24,0x12,0x8b,0x2f,0x33,0x0c,0x5c,0x7f,0xd0,0xa6,0xa3,0xa4,0x50,0x65,0x13,0x27,0x0e,0x26,0x9e,0x0d,0x37,0xf2,0xa7,0x4d,0xe4,0x52,0xe6,0xb4,0x38};
    std::uint8_t subtrahend0[32]    = {0x36,0xf6,0x75,0xcc,0x81,0xe7,0x4e,0xf5,0xe8,0xe2,0x5d,0x94,0x0e,0xd9,0x04,0x75,0x95,0x31,0x98,0x5d,0x5d,0x9d,0xc9,0xf8,0x18,0x18,0xe8,0x11,0x89,0x2f,0x90,0x2b};
    std::uint8_t difference0[32]    = {0x9b,0x48,0x92,0x57,0x90,0xa3,0xe0,0x3d,0x23,0x7a,0x22,0x3c,0x97,0xca,0x9f,0xda,0xcf,0xe1,0x8e,0xb0,0xc9,0x00,0x43,0x3f,0xda,0x8e,0x65,0xd2,0xc9,0xb7,0x24,0x0d};
    mont256_from_bytes(&ctx, minuend, minuend0);
    mont256_from_bytes(&ctx, subtrahend, subtrahend0);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference0, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend1[32]       = {0x8d,0x11,0x6e,0xce,0x17,0x38,0xf7,0xd9,0x3d,0x9c,0x17,0x24,0x11,0xe2,0x0b,0x8f,0x6b,0x0d,0x54,0x9b,0x6f,0x03,0x67,0x5a,0x16,0x00,0xa3,0x5a,0x09,0x99,0x50,0xd8};
    std::uint8_t subtrahend1[32]    = {0xa1,0x70,0xb3,0x38,0x39,0x26,0x30,0x59,0xf2,0x8c,0x10,0x5d,0x1f,0xb1,0x7c,0x23,0x90,0xc1,0x92,0xcf,0xd3,0xac,0x94,0xaf,0x0f,0x21,0xdd,0xb6,0x6c,0xad,0x4a,0x26};
    std::uint8_t difference1[32]    = {0xeb,0xa0,0xbb,0x94,0xde,0x12,0xc7,0x7f,0x4b,0x10,0x06,0xc6,0xf2,0x30,0x8f,0x6b,0xda,0x4b,0xc1,0xca,0x9b,0x56,0xd2,0xac,0x06,0xde,0xc5,0xa3,0x9c,0xec,0x06,0xb1};
    mont256_from_bytes(&ctx, minuend, minuend1);
    mont256_from_bytes(&ctx, subtrahend, subtrahend1);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference1, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend2[32]       = {0x0c,0xb1,0xe2,0x9c,0x65,0x8c,0xda,0x14,0x95,0xe6,0x0a,0xf5,0x93,0xbd,0x04,0xcf,0x0f,0xd6,0x30,0xf1,0xf2,0x9d,0x0d,0xa9,0x95,0x3f,0x48,0xf1,0xa0,0x9f,0x76,0xb5};
    std::uint8_t subtrahend2[32]    = {0x6b,0x4c,0xb2,0x42,0x4a,0x23,0xd5,0x96,0x22,0x17,0xbe,0xad,0xdb,0xc4,0x96,0xcb,0x8e,0x81,0x97,0x3e,0x0b,0xec,0xd7,0xb0,0x38,0x98,0xd1,0x90,0xf9,0xeb,0xda,0xcc};
    std::uint8_t difference2[32]    = {0xa1,0x65,0x30,0x59,0x1b,0x69,0x04,0x7e,0x73,0xce,0x4c,0x47,0xb7,0xf8,0x6e,0x03,0x81,0x54,0x99,0xb2,0xe6,0xb0,0x35,0xfa,0x5c,0xa6,0x77,0x60,0xa6,0xb3,0x9b,0xe8};
    mont256_from_bytes(&ctx, minuend, minuend2);
    mont256_from_bytes(&ctx, subtrahend, subtrahend2);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference2, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend3[32]       = {0xae,0x97,0xba,0x94,0xd0,0xed,0xa8,0x2f,0x8f,0x6d,0x05,0x58,0x4e,0xf8,0xaa,0x38,0x92,0x27,0x66,0x58,0x1e,0x27,0xa1,0xc0,0x8a,0x6a,0x63,0xec,0x24,0xed,0xe6,0xa4};
    std::uint8_t subtrahend3[32]    = {0x18,0xf1,0x35,0xd2,0x5f,0x55,0x72,0x03,0x30,0x18,0x50,0xc5,0xa3,0x8f,0xd5,0x47,0x92,0x3a,0x73,0x69,0x94,0xe3,0xbf,0x91,0x1a,0x61,0xdb,0xe2,0x2e,0x44,0x15,0x8b};
    std::uint8_t difference3[32]    = {0x95,0xa6,0x84,0xc2,0x71,0x98,0x36,0x2c,0x5f,0x54,0xb4,0x92,0xab,0x68,0xd4,0xf0,0xff,0xec,0xf2,0xee,0x89,0x43,0xe2,0x2f,0x70,0x08,0x88,0x09,0xf6,0xa9,0xd1,0x19};
    mont256_from_bytes(&ctx, minuend, minuend3);
    mont256_from_bytes(&ctx, subtrahend, subtrahend3);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference3, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend4[32]       = {0x7f,0x15,0x05,0x24,0x34,0xb9,0xb5,0xdf,0x9e,0x77,0x69,0xb1,0x0f,0x42,0x05,0xb4,0x90,0x7a,0x70,0xc3,0x10,0x12,0xf0,0x37,0xb6,0x4c,0xe4,0x22,0x8c,0x38,0xfb,0x29};
    std::uint8_t subtrahend4[32]    = {0xec,0x66,0xa7,0x87,0x95,0xe7,0x61,0xd1,0x77,0x31,0xaf,0x10,0x50,0x6b,0xf2,0xef,0xc6,0xf8,0x77,0x18,0x6d,0x76,0xb0,0x7e,0x88,0x1e,0xd1,0x62,0xae,0x2e,0xb1,0x54};
    std::uint8_t difference4[32]    = {0x92,0xae,0x5d,0x9b,0x9e,0xd2,0x54,0x0e,0x27,0x45,0xba,0xa0,0xbe,0xd6,0x12,0xc4,0xc9,0x81,0xf9,0xa9,0xa2,0x9c,0x3f,0xba,0x2e,0x2e,0x12,0xbf,0xde,0x0a,0x49,0xd4};
    mont256_from_bytes(&ctx, minuend, minuend4);
    mont256_from_bytes(&ctx, subtrahend, subtrahend4);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference4, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend5[32]       = {0xc7,0xa2,0xea,0x20,0xb2,0xf1,0x4c,0x94,0x2e,0x05,0x31,0x9a,0xcb,0x5c,0x74,0x27,0x3f,0x98,0xe2,0x77,0x4c,0xbd,0x87,0xad,0x5c,0x90,0xa9,0x58,0x74,0x03,0xe4,0x30};
    std::uint8_t subtrahend5[32]    = {0x57,0xee,0x05,0xcd,0xe0,0x09,0x02,0xc7,0x7e,0xbf,0xf2,0x06,0x86,0x73,0x47,0x21,0x4c,0xdd,0x20,0x55,0x93,0x0d,0x6e,0xaf,0x14,0xf4,0x73,0x3f,0x3e,0x7d,0x1b,0xfb};
    std::uint8_t difference5[32]    = {0x6f,0xb4,0xe4,0x52,0xd2,0xe8,0x49,0xcc,0xaf,0x45,0x3f,0x94,0x44,0xe9,0x2d,0x05,0xf2,0xbb,0xc2,0x21,0xb9,0xb0,0x18,0xfe,0x47,0x9c,0x36,0x19,0x35,0x86,0xc8,0x35};
    mont256_from_bytes(&ctx, minuend, minuend5);
    mont256_from_bytes(&ctx, subtrahend, subtrahend5);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference5, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend6[32]       = {0x83,0x0e,0x07,0xbc,0x1e,0x39,0x8f,0x10,0x12,0xbd,0x4a,0xce,0xfa,0xec,0xbd,0x38,0x9b,0xe4,0xbc,0xfc,0x49,0xb6,0x4a,0x08,0x72,0xe6,0xcc,0x3a,0xba,0xbc,0xed,0x20};
    std::uint8_t subtrahend6[32]    = {0x6b,0xf4,0x6c,0x69,0x7d,0x2c,0xaf,0x82,0xee,0xea,0xcb,0xe2,0x26,0xe8,0x75,0x55,0x57,0x90,0xf8,0x2e,0xc1,0xd3,0xfc,0xff,0x2a,0x3a,0xf4,0xd4,0x6b,0x0a,0x18,0xe8};
    std::uint8_t difference6[32]    = {0x17,0x19,0x9b,0x52,0xa1,0x0c,0xdf,0x8d,0x23,0xd2,0x7e,0xec,0xd4,0x04,0x47,0xe3,0x44,0x53,0xc4,0xcd,0x87,0xe2,0x4d,0x09,0x48,0xab,0xd7,0x66,0x4f,0xb2,0xd4,0x38};
    mont256_from_bytes(&ctx, minuend, minuend6);
    mont256_from_bytes(&ctx, subtrahend, subtrahend6);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference6, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend7[32]       = {0xca,0x02,0x13,0x5e,0x92,0xb1,0xd3,0xf2,0x8e,0xde,0x0d,0x7a,0xc3,0xba,0xea,0x9e,0x13,0xde,0xef,0x86,0xab,0x10,0x31,0xd0,0xf6,0x46,0xe1,0xf4,0x0a,0x09,0x7c,0x97};
    std::uint8_t subtrahend7[32]    = {0x7f,0x26,0x14,0x4b,0x98,0x28,0x9f,0xcd,0x59,0xa5,0x4a,0x7b,0xb1,0xfe,0xe0,0x8f,0x57,0x12,0x42,0x42,0x50,0x51,0xc1,0xcc,0xd1,0x7f,0x9a,0xca,0xe0,0x1f,0x50,0x57};
    std::uint8_t difference7[32]    = {0x4a,0xdb,0xff,0x12,0xfa,0x89,0x34,0x25,0x35,0x38,0xc2,0xff,0x11,0xbc,0x0a,0x0e,0xbc,0xcc,0xad,0x44,0x5a,0xbe,0x70,0x04,0x24,0xc7,0x47,0x29,0x29,0xea,0x2c,0x40};
    mont256_from_bytes(&ctx, minuend, minuend7);
    mont256_from_bytes(&ctx, subtrahend, subtrahend7);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference7, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend8[32]       = {0x45,0x1a,0xbd,0x81,0xf1,0xd6,0x9e,0xd6,0x17,0xf5,0xe8,0x37,0xd7,0x08,0x20,0xfe,0x11,0x9a,0x72,0xd1,0x74,0xc9,0xdf,0x6a,0xcc,0x01,0x1c,0xdd,0x94,0x74,0x03,0x1b};
    std::uint8_t subtrahend8[32]    = {0x4f,0x42,0x6d,0xcb,0xb3,0x94,0xfb,0x36,0xbb,0x2d,0x42,0x0f,0x0f,0x88,0x08,0x0b,0x10,0xa3,0xd6,0xb2,0xaa,0x05,0xe1,0x1a,0xb2,0x71,0x59,0x45,0x79,0x5e,0x82,0x29};
    std::uint8_t difference8[32]    = {0xf5,0xd8,0x4f,0xb5,0x3e,0x41,0xa3,0x9f,0x5c,0xc8,0xa6,0x28,0xc7,0x80,0x18,0xf3,0x00,0xf6,0x9c,0x1d,0xca,0xc3,0xfe,0x51,0x19,0x8f,0xc3,0x98,0x1b,0x15,0x80,0xf1};
    mont256_from_bytes(&ctx, minuend, minuend8);
    mont256_from_bytes(&ctx, subtrahend, subtrahend8);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference8, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend9[32]       = {0xb7,0x74,0xeb,0x52,0x48,0xdb,0x40,0xaf,0x72,0x15,0x83,0x70,0xd2,0x69,0xa9,0xa5,0xae,0x65,0x8f,0x33,0xfe,0x3b,0x89,0x0b,0x93,0xf4,0x48,0xb3,0xa5,0xaa,0x3c,0x81};
    std::uint8_t subtrahend9[32]    = {0x5a,0xff,0xb2,0x29,0x76,0x31,0xa9,0x92,0xf0,0xce,0x58,0x35,0x05,0xc6,0xaf,0x07,0x58,0xd5,0x56,0x3d,0xab,0x2c,0xd3,0x1e,0xe3,0x15,0x12,0x88,0x62,0xc3,0x3a,0x4f};
    std::uint8_t difference9[32]    = {0x5c,0x75,0x39,0x28,0xd2,0xa9,0x97,0x1c,0x81,0x47,0x2b,0x3b,0xcc,0xa2,0xfa,0x9e,0x55,0x90,0x38,0xf6,0x53,0x0e,0xb5,0xec,0xb0,0xdf,0x36,0x2b,0x42,0xe7,0x02,0x32};
    mont256_from_bytes(&ctx, minuend, minuend9);
    mont256_from_bytes(&ctx, subtrahend, subtrahend9);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference9, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend10[32]       = {0x49,0x95,0x23,0x99,0xc4,0xaa,0xea,0xc1,0x37,0xdc,0x76,0xfb,0x0f,0x17,0xa3,0x00,0x7e,0x62,0xaa,0x0a,0x1d,0xf9,0xfd,0x78,0x9c,0x65,0x39,0x38,0x2b,0x05,0x37,0xe6};
    std::uint8_t subtrahend10[32]    = {0x7f,0x1b,0x10,0x3c,0xdf,0x15,0x82,0xb0,0xea,0xb4,0x77,0xd2,0x64,0x15,0x47,0x9c,0x65,0xdc,0x9f,0x50,0x3f,0x63,0xaf,0x83,0xbd,0x05,0x61,0xe6,0x21,0x1c,0x70,0xcf};
    std::uint8_t difference10[32]    = {0xca,0x7a,0x13,0x5b,0xe5,0x95,0x68,0x10,0x4d,0x27,0xff,0x28,0xab,0x02,0x5b,0x64,0x18,0x86,0x0a,0xb8,0xde,0x96,0x4d,0xf5,0xdf,0x5f,0xd7,0x52,0x09,0xe8,0xc7,0x16};
    mont256_from_bytes(&ctx, minuend, minuend10);
    mont256_from_bytes(&ctx, subtrahend, subtrahend10);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference10, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend11[32]       = {0x23,0x0d,0x97,0x7e,0xe2,0x25,0x71,0x59,0x47,0x20,0x77,0x1f,0x8c,0xa8,0x18,0x11,0x66,0xd2,0x28,0x76,0x72,0xfd,0xf2,0x02,0x2a,0x96,0xfb,0x1a,0x14,0xa0,0xf9,0xe7};
    std::uint8_t subtrahend11[32]    = {0xfc,0x89,0x1b,0x4a,0x6a,0x50,0xdf,0x4d,0xb4,0xd6,0x6a,0x3a,0x47,0x46,0x9a,0x4d,0x8c,0xdb,0x30,0x5f,0xdd,0x2e,0x16,0x09,0x6e,0x36,0xaa,0xb0,0xd1,0xbc,0x52,0xd9};
    std::uint8_t difference11[32]    = {0x26,0x84,0x7c,0x33,0x77,0xd4,0x92,0x0b,0x92,0x4a,0x0c,0xe5,0x45,0x61,0x7d,0xc3,0xd9,0xf6,0xf8,0x15,0x95,0xcf,0xdb,0xf9,0xbc,0x60,0x50,0x69,0x42,0xe4,0xa7,0x0d};
    mont256_from_bytes(&ctx, minuend, minuend11);
    mont256_from_bytes(&ctx, subtrahend, subtrahend11);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference11, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend12[32]       = {0x15,0x3e,0x7c,0x2a,0x26,0xa2,0xc0,0xbd,0x3b,0x12,0x87,0xff,0xf5,0x2d,0xdf,0x5d,0x61,0x64,0x99,0xc9,0xe2,0x5a,0x76,0x05,0xae,0xc6,0xf0,0x24,0x5b,0xd8,0x6d,0x40};
    std::uint8_t subtrahend12[32]    = {0xd4,0xc2,0x8c,0x2e,0x7c,0x26,0x84,0x7f,0x03,0x16,0x90,0x9e,0x3b,0xbb,0xe9,0xea,0xa8,0x94,0x8c,0x89,0x3b,0x61,0x86,0x76,0x26,0xbb,0x7d,0xbd,0x2d,0x1c,0x9a,0xf0};
    std::uint8_t difference12[32]    = {0x40,0x7b,0xef,0xfa,0xaa,0x7c,0x3c,0x3e,0x37,0xfb,0xf7,0x61,0xb9,0x71,0xf5,0x72,0xb8,0xd0,0x0d,0x3f,0xa6,0xf8,0xef,0x90,0x88,0x0b,0x72,0x67,0x2e,0xbb,0xd2,0x4f};
    mont256_from_bytes(&ctx, minuend, minuend12);
    mont256_from_bytes(&ctx, subtrahend, subtrahend12);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference12, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend13[32]       = {0x88,0xda,0xf4,0x01,0x6b,0x40,0x13,0xef,0x25,0x4b,0x0c,0x4e,0x01,0x0c,0x47,0x59,0x48,0x2c,0x9c,0xbc,0x43,0x43,0x5c,0xc5,0x2e,0xae,0x05,0xcf,0x96,0xd0,0xcc,0x5f};
    std::uint8_t subtrahend13[32]    = {0xdb,0xf4,0xa8,0xb2,0xb0,0xc4,0x31,0x2d,0x20,0x20,0x36,0x26,0xf3,0xfe,0x39,0xc0,0x51,0x90,0x88,0xf5,0x90,0xfb,0xbd,0x11,0x9c,0x1c,0xaa,0xf7,0x5e,0x87,0x66,0xed};
    std::uint8_t difference13[32]    = {0xac,0xe6,0x4b,0x4d,0xba,0x7b,0xe2,0xc2,0x05,0x2a,0xd6,0x27,0x0d,0x0e,0x0d,0x98,0xf6,0x9c,0x13,0xc5,0xb2,0x47,0x9f,0xb4,0x92,0x91,0x5a,0xd8,0x38,0x49,0x65,0x71};
    mont256_from_bytes(&ctx, minuend, minuend13);
    mont256_from_bytes(&ctx, subtrahend, subtrahend13);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference13, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend14[32]       = {0x74,0xe6,0x9a,0x5d,0x0d,0xd2,0x7a,0x65,0xbd,0x62,0x88,0x81,0xad,0x1b,0x72,0xdb,0xa7,0xab,0xe1,0xc2,0x9e,0x1a,0x8e,0xf4,0xf3,0x41,0xe0,0x7a,0x83,0xf7,0x3f,0x16};
    std::uint8_t subtrahend14[32]    = {0x8f,0x2c,0x6e,0xc8,0xcc,0x41,0x69,0xa3,0xae,0x3a,0x2b,0x7f,0xdf,0xe0,0x18,0x93,0xf3,0xae,0xd0,0xb6,0xc7,0xac,0x14,0x91,0xde,0xf8,0x83,0x34,0xe6,0x47,0xcb,0x8f};
    std::uint8_t difference14[32]    = {0xe5,0xba,0x2b,0x93,0x41,0x91,0x10,0xc2,0x0f,0x28,0x5d,0x01,0xcd,0x3b,0x5a,0x47,0xb3,0xfd,0x11,0x0a,0xd6,0x6e,0x7a,0x64,0x14,0x49,0x5d,0x45,0x9d,0xaf,0x73,0x86};
    mont256_from_bytes(&ctx, minuend, minuend14);
    mont256_from_bytes(&ctx, subtrahend, subtrahend14);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference14, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend15[32]       = {0x66,0x83,0x68,0x86,0xa2,0x60,0xcd,0x0b,0x7b,0x45,0x14,0x5c,0x1a,0x81,0x68,0x2c,0x64,0xe5,0x0c,0xad,0x66,0x23,0x7a,0x04,0x65,0xe7,0xe4,0x23,0x64,0x72,0xf1,0xa3};
    std::uint8_t subtrahend15[32]    = {0x1c,0x24,0x42,0xf9,0x29,0x8c,0xb3,0xa5,0x70,0xcc,0xec,0x31,0x35,0x71,0x81,0x0a,0xfc,0x13,0x2d,0x0d,0x11,0x3d,0xb1,0x7d,0x30,0xcb,0xc9,0x7d,0x0f,0xef,0x79,0x28};
    std::uint8_t difference15[32]    = {0x4a,0x5f,0x25,0x8d,0x78,0xd4,0x19,0x66,0x0a,0x78,0x28,0x2a,0xe5,0x0f,0xe7,0x21,0x68,0xd1,0xdf,0xa0,0x54,0xe5,0xc8,0x87,0x35,0x1c,0x1a,0xa6,0x54,0x83,0x78,0x7b};
    mont256_from_bytes(&ctx, minuend, minuend15);
    mont256_from_bytes(&ctx, subtrahend, subtrahend15);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference15, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend16[32]       = {0x89,0x5f,0xd7,0xb3,0x26,0xb9,0x4c,0x7f,0x91,0x18,0xbb,0x16,0x00,0x0f,0x49,0xc8,0x1a,0x35,0x8c,0xa0,0x0d,0x75,0x98,0x5d,0x99,0xc9,0x43,0x09,0x57,0x0d,0xc1,0x95};
    std::uint8_t subtrahend16[32]    = {0x35,0x3c,0x63,0x1c,0xdf,0xd4,0x3f,0x37,0x12,0x00,0x33,0x9d,0x06,0x87,0x39,0xfa,0x9d,0x1d,0xe2,0xa0,0x5d,0x15,0x8a,0x2f,0xf2,0xee,0x4e,0x45,0x19,0xf9,0x91,0x9c};
    std::uint8_t difference16[32]    = {0x54,0x23,0x74,0x96,0x46,0xe5,0x0d,0x48,0x7f,0x18,0x87,0x78,0xf9,0x88,0x0f,0xcd,0x7d,0x17,0xa9,0xff,0xb0,0x60,0x0e,0x2d,0xa6,0xda,0xf4,0xc4,0x3d,0x14,0x2f,0xf9};
    mont256_from_bytes(&ctx, minuend, minuend16);
    mont256_from_bytes(&ctx, subtrahend, subtrahend16);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference16, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend17[32]       = {0x9a,0x2e,0xf8,0x0f,0x58,0xee,0x85,0x71,0xf4,0x99,0x8d,0x7c,0x40,0x93,0xf6,0xde,0xa2,0x68,0xaa,0x87,0x26,0x07,0x67,0x9d,0x60,0x50,0x91,0x4a,0x9d,0x33,0xa0,0x1c};
    std::uint8_t subtrahend17[32]    = {0xfa,0x52,0x9b,0xa3,0xfe,0x3b,0xfa,0xda,0x7c,0xf2,0x07,0x24,0xd9,0x53,0xee,0x26,0x1d,0x87,0xce,0xc3,0x1f,0x72,0x96,0xab,0x79,0x61,0xfd,0x92,0x5d,0x39,0xd0,0xa8};
    std::uint8_t difference17[32]    = {0x9f,0xdc,0x5c,0x6a,0x5a,0xb2,0x8a,0x97,0x77,0xa7,0x86,0x57,0x67,0x40,0x08,0xb8,0x84,0xe0,0xdb,0xc3,0x06,0x94,0xd0,0xf2,0xe6,0xee,0x93,0xb8,0x3f,0xf9,0xcf,0x73};
    mont256_from_bytes(&ctx, minuend, minuend17);
    mont256_from_bytes(&ctx, subtrahend, subtrahend17);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference17, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend18[32]       = {0xbf,0xea,0xa1,0x55,0x1a,0x28,0xf7,0xb3,0x24,0xe4,0xe2,0x5a,0x15,0xfc,0x89,0x9e,0x4f,0xd5,0x8d,0xbe,0x7b,0xdc,0x96,0x8b,0x7a,0xfb,0x2c,0x68,0x77,0x4b,0x15,0xd7};
    std::uint8_t subtrahend18[32]    = {0x84,0x2e,0x7f,0xc2,0x29,0x54,0x0a,0x6e,0xb1,0x2a,0xa1,0xf6,0xd4,0x2f,0xdd,0xbb,0x7a,0x86,0xf7,0xa2,0x43,0xc7,0x1b,0x9a,0xbd,0x87,0xa8,0x65,0x57,0xb6,0xfb,0x7e};
    std::uint8_t difference18[32]    = {0x3b,0xbc,0x21,0x92,0xf0,0xd4,0xed,0x44,0x73,0xba,0x40,0x63,0x41,0xcc,0xab,0xe2,0xd5,0x4e,0x96,0x1c,0x38,0x15,0x7a,0xf0,0xbd,0x73,0x84,0x03,0x1f,0x94,0x1a,0x59};
    mont256_from_bytes(&ctx, minuend, minuend18);
    mont256_from_bytes(&ctx, subtrahend, subtrahend18);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference18, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend19[32]       = {0xb0,0xa8,0x44,0xe5,0x25,0x87,0xbe,0x6b,0x5c,0x9b,0xcf,0x35,0x87,0x3b,0xe0,0x78,0xf3,0xb7,0xa5,0x0d,0xf3,0x73,0xca,0x53,0x34,0x88,0xf8,0x76,0x05,0xe9,0x99,0xf3};
    std::uint8_t subtrahend19[32]    = {0xa4,0x96,0x36,0xa2,0xfa,0x7f,0x0e,0xab,0x4c,0x4f,0x9b,0x06,0x87,0x32,0x2e,0x25,0xc2,0x15,0xa8,0x2a,0x06,0xec,0x41,0xad,0xea,0x05,0x75,0x43,0x8b,0x0d,0x59,0x0b};
    std::uint8_t difference19[32]    = {0x0c,0x12,0x0e,0x42,0x2b,0x08,0xaf,0xc0,0x10,0x4c,0x34,0x2f,0x00,0x09,0xb2,0x53,0x31,0xa1,0xfc,0xe3,0xec,0x87,0x88,0xa5,0x4a,0x83,0x83,0x32,0x7a,0xdc,0x40,0xe8};
    mont256_from_bytes(&ctx, minuend, minuend19);
    mont256_from_bytes(&ctx, subtrahend, subtrahend19);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference19, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend20[32]       = {0xe8,0x83,0xa1,0xd4,0x5d,0xe0,0x09,0x97,0x84,0xb5,0xa8,0x18,0x42,0xd8,0x72,0x08,0xd8,0x6f,0x40,0xf6,0xb2,0x39,0xf3,0xc7,0x17,0x4c,0x77,0xa2,0xdd,0x02,0xde,0x92};
    std::uint8_t subtrahend20[32]    = {0x80,0xb0,0xc0,0x8b,0xc7,0x70,0x24,0x20,0x8a,0xa4,0x24,0x8c,0x88,0x57,0xf9,0xa4,0x39,0x08,0xf2,0x27,0xc5,0x9d,0xb9,0x16,0x5b,0x0e,0xe7,0x6f,0x2a,0xc3,0x44,0x46};
    std::uint8_t difference20[32]    = {0x67,0xd2,0xe1,0x48,0x96,0x6f,0xe5,0x76,0xfa,0x11,0x83,0x8b,0xba,0x80,0x78,0x64,0x9f,0x66,0x4e,0xce,0xec,0x9c,0x3a,0xb0,0xbc,0x3d,0x90,0x33,0xb2,0x3f,0x9a,0x4c};
    mont256_from_bytes(&ctx, minuend, minuend20);
    mont256_from_bytes(&ctx, subtrahend, subtrahend20);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference20, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend21[32]       = {0xc2,0x21,0x6b,0x02,0xfc,0x24,0x1d,0x0b,0xc9,0xd4,0x88,0xb1,0xcf,0xbf,0x33,0x60,0x9c,0xfc,0x86,0x52,0x39,0x19,0x42,0x42,0xa2,0xed,0xdb,0xbd,0x54,0x64,0xec,0xc2};
    std::uint8_t subtrahend21[32]    = {0xcd,0xa6,0xc6,0xfd,0xbd,0x68,0x51,0x67,0x66,0x93,0x40,0x36,0xd1,0x7e,0x44,0x97,0x3d,0x48,0x82,0xa5,0xce,0x5b,0x2a,0x92,0x31,0xf5,0x17,0x07,0xda,0x45,0xe1,0x8a};
    std::uint8_t difference21[32]    = {0xf4,0x7a,0xa4,0x04,0x3e,0xbb,0xcb,0xa4,0x63,0x41,0x48,0x7a,0xfe,0x40,0xee,0xc9,0x5f,0xb4,0x03,0xab,0x6a,0xbe,0x17,0xb1,0x70,0xf8,0xc4,0xb5,0x7a,0x1f,0x0b,0x37};
    mont256_from_bytes(&ctx, minuend, minuend21);
    mont256_from_bytes(&ctx, subtrahend, subtrahend21);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference21, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend22[32]       = {0xfd,0x56,0xa9,0x26,0x07,0x6b,0x3e,0x36,0xbb,0x23,0x13,0xf5,0x5b,0x06,0x25,0x8e,0x7e,0x26,0xf3,0x6a,0x84,0x83,0xf8,0xb8,0x33,0x2d,0xd3,0x31,0x3a,0x0b,0x99,0x65};
    std::uint8_t subtrahend22[32]    = {0x9a,0xea,0x64,0x29,0xb1,0x49,0x1e,0x24,0x31,0x92,0xb7,0x04,0x42,0x59,0x40,0x52,0x78,0xe4,0xb9,0x8d,0x47,0x87,0xf9,0x3b,0xca,0x44,0xeb,0x86,0x07,0x26,0xe2,0x5c};
    std::uint8_t difference22[32]    = {0x62,0x6c,0x44,0xfc,0x56,0x22,0x20,0x12,0x89,0x90,0x5c,0xf1,0x18,0xac,0xe5,0x3c,0x05,0x42,0x39,0xdd,0x3c,0xfb,0xff,0x7c,0x68,0xe8,0xe7,0xab,0x32,0xe4,0xb7,0x09};
    mont256_from_bytes(&ctx, minuend, minuend22);
    mont256_from_bytes(&ctx, subtrahend, subtrahend22);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference22, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend23[32]       = {0x59,0x7a,0x1e,0xcf,0xfc,0xf0,0x0f,0xec,0xb9,0x1e,0xe9,0xe5,0xef,0xe0,0x9f,0x07,0xce,0xfe,0x2a,0x1f,0x72,0x7d,0x83,0x49,0x58,0x22,0xcb,0x77,0xf4,0xde,0x2c,0x08};
    std::uint8_t subtrahend23[32]    = {0x78,0x57,0x29,0x76,0x3a,0x12,0x91,0x7c,0x1a,0x26,0xf8,0x89,0x38,0x70,0x38,0x00,0x14,0x9e,0x25,0x9b,0x5d,0x58,0xc7,0x05,0xf9,0x79,0xd0,0x4a,0xf4,0x7a,0xeb,0xdd};
    std::uint8_t difference23[32]    = {0xe1,0x22,0xf5,0x58,0xc2,0xdd,0x7e,0x70,0x9e,0xf7,0xf1,0x5c,0xb7,0x70,0x67,0x07,0xba,0x60,0x04,0x83,0x15,0x24,0xbc,0x44,0x5e,0xa8,0xfb,0x2d,0x00,0x63,0x40,0x2a};
    mont256_from_bytes(&ctx, minuend, minuend23);
    mont256_from_bytes(&ctx, subtrahend, subtrahend23);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference23, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend24[32]       = {0x9c,0x3a,0x23,0xcd,0xe6,0x7a,0x9b,0x75,0xfc,0x39,0x47,0x24,0x9f,0xc2,0xd0,0xa1,0x7b,0x8f,0x2a,0xb5,0x34,0x51,0xd0,0x13,0x56,0x75,0xf6,0xad,0x32,0x5b,0x55,0xdd};
    std::uint8_t subtrahend24[32]    = {0xa4,0xa4,0x5e,0xff,0xcc,0xb5,0x73,0xd9,0x58,0x10,0xd6,0x0e,0xa7,0x29,0x91,0xb9,0xe8,0xc1,0x47,0x43,0x7a,0xbe,0xc5,0x39,0x00,0x7d,0x10,0x34,0xd7,0x26,0xc8,0x6b};
    std::uint8_t difference24[32]    = {0xf7,0x95,0xc4,0xcd,0x19,0xc5,0x27,0x9c,0xa4,0x28,0x71,0x15,0xf8,0x99,0x3e,0xe7,0x92,0xcd,0xe3,0x70,0xb9,0x93,0x0a,0xdb,0x55,0xf8,0xe6,0x78,0x5b,0x34,0x8d,0x71};
    mont256_from_bytes(&ctx, minuend, minuend24);
    mont256_from_bytes(&ctx, subtrahend, subtrahend24);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference24, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend25[32]       = {0xb6,0x24,0x67,0x71,0xc8,0x45,0x00,0x70,0x63,0x77,0x14,0x07,0xe8,0xe7,0x27,0x89,0x1e,0xb2,0x01,0x09,0xa9,0x1c,0x24,0x39,0xd5,0xab,0x8b,0x4d,0x15,0xb4,0x0a,0xeb};
    std::uint8_t subtrahend25[32]    = {0xa2,0xc6,0x8e,0x45,0xca,0x04,0xc7,0x9f,0x6f,0x15,0xb6,0xad,0x2d,0xb3,0x99,0x7f,0xe3,0x96,0x39,0xbe,0x7a,0x60,0x5a,0x91,0x33,0x06,0x98,0xa1,0xc0,0x09,0x34,0x92};
    std::uint8_t difference25[32]    = {0x13,0x5d,0xd9,0x2b,0xfe,0x40,0x38,0xd0,0xf4,0x61,0x5d,0x5a,0xbb,0x33,0x8e,0x09,0x3b,0x1b,0xc7,0x4b,0x2e,0xbb,0xc9,0xa8,0xa2,0xa4,0xf2,0xab,0x55,0xaa,0xd6,0x59};
    mont256_from_bytes(&ctx, minuend, minuend25);
    mont256_from_bytes(&ctx, subtrahend, subtrahend25);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference25, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend26[32]       = {0x76,0x91,0xb0,0x6f,0x65,0x55,0xab,0xfe,0xb8,0xc9,0x81,0x7a,0xf8,0xbe,0x88,0x31,0xf2,0x37,0xe4,0x5a,0xcd,0x02,0xc5,0xe1,0x16,0x35,0x3d,0x03,0x55,0x1f,0xd8,0xf9};
    std::uint8_t subtrahend26[32]    = {0xfe,0x3c,0x9c,0x8f,0x2b,0x85,0x5c,0x1f,0x28,0xaa,0xca,0x51,0xb9,0x8c,0x67,0xc2,0x15,0xbd,0x44,0x8f,0xf2,0x61,0x49,0xed,0xbe,0x4c,0x5c,0xe6,0x66,0xc1,0x49,0x4e};
    std::uint8_t difference26[32]    = {0x78,0x55,0x13,0xdf,0x39,0xd0,0x4f,0xdf,0x90,0x1e,0xb7,0x29,0x3f,0x32,0x20,0x6f,0xdc,0x7a,0x9f,0xc9,0xda,0xa1,0x7b,0xf4,0x57,0xe8,0xe0,0x1c,0xee,0x5e,0x8f,0xaa};
    mont256_from_bytes(&ctx, minuend, minuend26);
    mont256_from_bytes(&ctx, subtrahend, subtrahend26);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference26, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend27[32]       = {0xa7,0xe6,0x52,0x9b,0xce,0x76,0xe9,0xf4,0x77,0x21,0x6e,0x9e,0xe7,0xa4,0x63,0x09,0x97,0x3f,0x79,0x86,0x26,0xb1,0xcf,0xfc,0x07,0x0d,0x71,0x09,0x20,0x85,0x96,0x34};
    std::uint8_t subtrahend27[32]    = {0xef,0xfd,0xde,0xea,0xa8,0x42,0xbc,0x19,0x79,0x6f,0x74,0xad,0xfa,0xf5,0x54,0x96,0x98,0x8a,0xf3,0xfb,0xd3,0x96,0x30,0xd6,0x9c,0x90,0x11,0xef,0x25,0x6b,0xad,0xf9};
    std::uint8_t difference27[32]    = {0xb7,0xe8,0x73,0xb0,0x26,0x34,0x2d,0xda,0xfd,0xb1,0xf9,0xf0,0xec,0xaf,0x0e,0x72,0xfe,0xb4,0x85,0x89,0x53,0x1b,0x9f,0x26,0x6a,0x7d,0x5f,0x19,0xfb,0x19,0xe8,0x3a};
    mont256_from_bytes(&ctx, minuend, minuend27);
    mont256_from_bytes(&ctx, subtrahend, subtrahend27);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference27, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend28[32]       = {0xcc,0xa2,0xa9,0x2b,0x03,0xa5,0x6c,0xc1,0x05,0x7a,0x40,0xb2,0x21,0x88,0x28,0x7e,0x8c,0x5c,0x71,0x5f,0x8c,0x74,0xfc,0x1e,0x27,0xe9,0xe0,0x6f,0x59,0xb4,0x4e,0x92};
    std::uint8_t subtrahend28[32]    = {0x23,0xa5,0xef,0x88,0xef,0x02,0x09,0x0b,0xbf,0xde,0xfc,0x15,0x86,0xce,0x03,0xf9,0x1a,0x4f,0x44,0xf9,0xa6,0x51,0x14,0x45,0xb9,0xf3,0x63,0x5c,0xf8,0x8c,0x42,0x2b};
    std::uint8_t difference28[32]    = {0xa8,0xfc,0xb9,0xa2,0x14,0xa3,0x63,0xb5,0x45,0x9b,0x44,0x9c,0x9a,0xba,0x24,0x85,0x72,0x0d,0x2c,0x65,0xe6,0x23,0xe7,0xd8,0x6d,0xf6,0x7d,0x12,0x61,0x28,0x0c,0x67};
    mont256_from_bytes(&ctx, minuend, minuend28);
    mont256_from_bytes(&ctx, subtrahend, subtrahend28);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference28, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend29[32]       = {0x07,0x2a,0x98,0xd2,0x36,0x06,0xde,0xfc,0xdf,0xb8,0x5c,0x0d,0xd3,0x7e,0xe9,0x15,0x31,0xde,0xc4,0xf4,0xdf,0x2a,0x8b,0x79,0xfc,0x8e,0x80,0xb3,0x6f,0x0e,0x22,0x89};
    std::uint8_t subtrahend29[32]    = {0x53,0x74,0x09,0x02,0x96,0x20,0xbf,0x0d,0xc3,0x80,0x84,0xa0,0x3d,0x93,0xfd,0x4c,0x80,0x4c,0x25,0xd6,0x4a,0xff,0xdc,0xd1,0x36,0x78,0xbc,0x8d,0x40,0x78,0x3f,0x0a};
    std::uint8_t difference29[32]    = {0xb3,0xb6,0x8f,0xce,0x9f,0xe6,0x1f,0xef,0x1c,0x37,0xd7,0x6d,0x95,0xea,0xeb,0xc8,0xb1,0x92,0x9f,0x1d,0x94,0x2a,0xae,0xa9,0xc6,0x15,0xc4,0x26,0x2e,0x95,0xe3,0x7e};
    mont256_from_bytes(&ctx, minuend, minuend29);
    mont256_from_bytes(&ctx, subtrahend, subtrahend29);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference29, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend30[32]       = {0xbd,0x6b,0x88,0x1a,0xe8,0xf6,0xe0,0xbd,0x0f,0x97,0x70,0x44,0x21,0x8e,0x0b,0x7b,0xd5,0x8d,0xcd,0xb4,0x6b,0x44,0x68,0x06,0x8b,0x5a,0xb3,0xee,0x42,0x65,0xbb,0x31};
    std::uint8_t subtrahend30[32]    = {0x84,0x4a,0x70,0x34,0xe7,0x7f,0xfe,0x48,0xd0,0xa6,0xec,0x17,0x95,0x56,0x58,0x5e,0xa9,0x97,0xf3,0x51,0x75,0x4a,0x09,0xcd,0xe5,0xcf,0xed,0xfa,0x5a,0x91,0x96,0xf0};
    std::uint8_t difference30[32]    = {0x39,0x21,0x17,0xe6,0x01,0x76,0xe2,0x74,0x3e,0xf0,0x84,0x2c,0x8c,0x37,0xb3,0x1d,0x2b,0xf5,0xda,0x62,0xf5,0xfa,0x5e,0x38,0xa5,0x8a,0xc5,0xf3,0xe7,0xd4,0x24,0x41};
    mont256_from_bytes(&ctx, minuend, minuend30);
    mont256_from_bytes(&ctx, subtrahend, subtrahend30);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference30, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend31[32]       = {0x26,0xde,0xbf,0xdb,0x88,0x25,0xae,0x56,0x21,0x79,0xb3,0x7d,0x80,0x6c,0x10,0xb5,0xe0,0xcf,0xab,0x4c,0xea,0xef,0xc4,0xd2,0xd3,0xbf,0x6d,0x01,0x6b,0xae,0x4b,0x5b};
    std::uint8_t subtrahend31[32]    = {0x9b,0xca,0x3c,0xb7,0x2e,0xe0,0x28,0x9d,0xc6,0xc9,0x1b,0x92,0x70,0xac,0x06,0xac,0xdf,0x70,0x30,0x17,0x04,0xc9,0xd7,0x8d,0x82,0xb3,0x35,0x99,0x86,0x04,0x87,0x19};
    std::uint8_t difference31[32]    = {0x8b,0x14,0x83,0x23,0x59,0x45,0x85,0xb8,0x5a,0xb0,0x97,0xeb,0x0f,0xc0,0x0a,0x09,0x01,0x5f,0x7b,0x34,0xe6,0x25,0xed,0x46,0x51,0x0c,0x37,0x67,0xe5,0xa9,0xc4,0x41};
    mont256_from_bytes(&ctx, minuend, minuend31);
    mont256_from_bytes(&ctx, subtrahend, subtrahend31);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference31, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend32[32]       = {0x9e,0x7d,0x6b,0x37,0x79,0x36,0xd5,0x36,0x24,0x3d,0x35,0x70,0x2c,0x1e,0xea,0x1f,0x26,0x59,0x74,0xa7,0xcc,0x96,0x6f,0x46,0xc6,0xaa,0x7d,0x55,0x01,0x01,0xb8,0x11};
    std::uint8_t subtrahend32[32]    = {0x87,0xdd,0xae,0xb7,0x84,0xb2,0x80,0x54,0xae,0xad,0x44,0xb0,0x53,0x73,0x90,0xe5,0x0f,0xcf,0x31,0xca,0x8e,0x75,0x2f,0xdf,0x1e,0xce,0x61,0x5d,0xb9,0xa6,0x44,0x2e};
    std::uint8_t difference32[32]    = {0x16,0x9f,0xbc,0x7f,0xf4,0x84,0x54,0xe1,0x75,0x8f,0xf0,0xbf,0xd8,0xab,0x59,0x3a,0x16,0x8a,0x42,0xdd,0x3e,0x21,0x3f,0x67,0xa7,0xdc,0x1b,0xf7,0x47,0x5b,0x73,0xe3};
    mont256_from_bytes(&ctx, minuend, minuend32);
    mont256_from_bytes(&ctx, subtrahend, subtrahend32);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference32, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend33[32]       = {0x0e,0x8b,0xec,0x94,0x8f,0x6f,0x91,0x5f,0xe2,0x1b,0x37,0xca,0x1b,0x29,0xfc,0x99,0xc6,0xc8,0x0e,0x2b,0xc8,0xc6,0x14,0xb2,0x7b,0x84,0x44,0xd1,0x8e,0x31,0x70,0x41};
    std::uint8_t subtrahend33[32]    = {0x73,0xc1,0xcd,0x2c,0x81,0xf9,0x8b,0x52,0x19,0x05,0xd5,0x91,0xc5,0xb2,0xe7,0x5a,0x0a,0xcd,0x8b,0xe1,0x46,0xe4,0x09,0x90,0x30,0xf9,0x70,0x58,0x3f,0x9d,0x52,0xf9};
    std::uint8_t difference33[32]    = {0x9a,0xca,0x1f,0x67,0x0d,0x76,0x06,0x0d,0xc9,0x15,0x62,0x38,0x55,0x77,0x15,0x3f,0xbb,0xfa,0x82,0x49,0x81,0xe2,0x0b,0x23,0x4a,0x8a,0xd4,0x79,0x4e,0x94,0x1d,0x47};
    mont256_from_bytes(&ctx, minuend, minuend33);
    mont256_from_bytes(&ctx, subtrahend, subtrahend33);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference33, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend34[32]       = {0x53,0x5b,0x6a,0x43,0x71,0x78,0xba,0x0a,0x10,0x38,0xf0,0xb5,0xe9,0x98,0xd0,0xee,0xe4,0xdd,0xf9,0xb9,0xc2,0x8e,0xe9,0x07,0x07,0x22,0x35,0xc2,0x8f,0xcd,0x7f,0x40};
    std::uint8_t subtrahend34[32]    = {0x46,0xf5,0xa1,0xb4,0xb1,0x56,0xd1,0xad,0x33,0x0c,0x16,0xa3,0x83,0x1d,0x03,0xbf,0x9b,0x2b,0xd6,0xc0,0x81,0x6b,0xee,0x06,0xf9,0x2e,0x23,0x39,0x9c,0xce,0xa0,0x98};
    std::uint8_t difference34[32]    = {0x0c,0x65,0xc8,0x8e,0xc0,0x21,0xe8,0x5c,0xdd,0x2c,0xda,0x12,0x66,0x7b,0xcd,0x2f,0x49,0xb2,0x22,0xf9,0x41,0x22,0xfb,0x00,0x0d,0xf4,0x12,0x88,0xf2,0xfe,0xde,0xa8};
    mont256_from_bytes(&ctx, minuend, minuend34);
    mont256_from_bytes(&ctx, subtrahend, subtrahend34);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference34, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend35[32]       = {0x3f,0x66,0x5e,0xde,0xf1,0x06,0x37,0xce,0x81,0xfc,0x06,0x9e,0x7a,0x60,0x96,0x83,0xce,0xaf,0x49,0x15,0x88,0x85,0x64,0xe8,0x82,0x16,0x85,0x8f,0x73,0xcc,0xef,0x03};
    std::uint8_t subtrahend35[32]    = {0xec,0x3b,0x96,0x05,0x42,0x74,0xa3,0xeb,0xed,0x84,0xe9,0x1e,0xf1,0x32,0xbf,0x2d,0xe0,0x40,0x01,0x5c,0xe0,0x64,0xa1,0x14,0x85,0xf1,0x11,0x5b,0xb2,0xff,0xf1,0x7b};
    std::uint8_t difference35[32]    = {0x53,0x2a,0xc8,0xd8,0xae,0x91,0x93,0xe2,0x94,0x77,0x1d,0x7f,0x89,0x2d,0xd7,0x55,0xee,0x6f,0x47,0xb7,0xa8,0x20,0xc3,0xd4,0xfc,0x25,0x74,0x33,0xc0,0xcc,0xfd,0x87};
    mont256_from_bytes(&ctx, minuend, minuend35);
    mont256_from_bytes(&ctx, subtrahend, subtrahend35);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference35, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend36[32]       = {0x6a,0xa8,0xb9,0xe0,0x23,0x1b,0x3e,0x14,0x72,0x91,0x35,0xbd,0xd7,0x0a,0x39,0xd1,0x33,0xdc,0xd7,0x7f,0xf1,0x79,0xf2,0xd2,0xe4,0x8b,0x96,0x62,0x8f,0x3c,0x4b,0xe3};
    std::uint8_t subtrahend36[32]    = {0x6d,0xa7,0x9a,0x87,0x3d,0x9a,0x80,0x79,0xab,0xd0,0xd7,0xfb,0x12,0x92,0x61,0x85,0x50,0xe4,0x0d,0x54,0x71,0x2e,0xa6,0xb3,0x64,0x71,0xfd,0xe4,0x1f,0x22,0x9d,0xd0};
    std::uint8_t difference36[32]    = {0xfd,0x01,0x1f,0x57,0xe5,0x80,0xbd,0x9a,0xc6,0xc0,0x5d,0xc2,0xc4,0x77,0xd8,0x4b,0xe2,0xf8,0xca,0x2a,0x80,0x4b,0x4c,0x20,0x80,0x19,0x98,0x7e,0x70,0x19,0xae,0x12};
    mont256_from_bytes(&ctx, minuend, minuend36);
    mont256_from_bytes(&ctx, subtrahend, subtrahend36);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference36, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend37[32]       = {0xc6,0xe5,0x0d,0xf2,0xe5,0xa3,0x86,0x3e,0x1f,0x52,0x52,0x65,0xc8,0xb0,0x07,0xee,0x4d,0x82,0xfe,0xac,0xab,0x62,0x86,0xcd,0x36,0x72,0xd6,0xae,0x12,0xb8,0x0a,0xed};
    std::uint8_t subtrahend37[32]    = {0x40,0xcb,0xac,0xd0,0x24,0x9a,0x45,0x84,0x5d,0xbe,0x30,0x23,0xa9,0x06,0x92,0x2f,0xa4,0xb9,0xa9,0xc4,0xb7,0x53,0xa1,0xee,0xf0,0x83,0x60,0x85,0x27,0x89,0xd0,0x59};
    std::uint8_t difference37[32]    = {0x86,0x19,0x61,0x22,0xc1,0x09,0x40,0xb9,0xc1,0x94,0x22,0x42,0x1f,0xa9,0x75,0xbe,0xa8,0xc9,0x54,0xe7,0xf4,0x0e,0xe4,0xde,0x45,0xef,0x76,0x28,0xeb,0x2e,0x3a,0x94};
    mont256_from_bytes(&ctx, minuend, minuend37);
    mont256_from_bytes(&ctx, subtrahend, subtrahend37);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference37, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend38[32]       = {0x18,0x18,0x9a,0xf4,0xf3,0xd7,0x4f,0x82,0xbf,0x26,0x8e,0xa0,0x38,0x36,0xe8,0x65,0x77,0xbd,0x89,0x1f,0xf7,0xb1,0x03,0xdf,0x23,0x23,0x1e,0x1e,0xe2,0x01,0x55,0x22};
    std::uint8_t subtrahend38[32]    = {0x39,0x45,0x33,0x6b,0xd5,0x1b,0x18,0x15,0xaa,0xf7,0x19,0xf3,0xfd,0x68,0x37,0x3b,0x29,0xac,0xf1,0xa5,0x7c,0xbd,0x1f,0x5a,0xe2,0x8a,0xf6,0x04,0x65,0xf4,0x29,0x86};
    std::uint8_t difference38[32]    = {0xde,0xd3,0x67,0x88,0x1e,0xbc,0x37,0x6d,0x14,0x2f,0x74,0xac,0x3a,0xce,0xb1,0x2a,0x4e,0x10,0x97,0x79,0x7a,0xf3,0xe4,0x85,0x40,0x98,0x28,0x1a,0x7c,0x0d,0x2b,0x9b};
    mont256_from_bytes(&ctx, minuend, minuend38);
    mont256_from_bytes(&ctx, subtrahend, subtrahend38);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference38, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend39[32]       = {0x6b,0xd8,0xc6,0x76,0x56,0xd0,0x50,0xcd,0x67,0x60,0x13,0x67,0x83,0xfe,0xb1,0x7b,0xfe,0x7b,0x8a,0xe4,0x6e,0x78,0x36,0xa4,0xb4,0xd1,0x9e,0xc1,0x29,0x55,0xd6,0xf0};
    std::uint8_t subtrahend39[32]    = {0x56,0x85,0xd6,0x24,0x04,0xfc,0xd5,0x55,0x5d,0xaf,0x10,0x6d,0xb8,0xde,0xe0,0x81,0x17,0x9a,0x07,0x1e,0x51,0x8a,0xe4,0x52,0x5b,0x4b,0x1b,0x75,0x32,0x1c,0x52,0x96};
    std::uint8_t difference39[32]    = {0x15,0x52,0xf0,0x52,0x51,0xd3,0x7b,0x78,0x09,0xb1,0x02,0xf9,0xcb,0x1f,0xd0,0xfa,0xe6,0xe1,0x83,0xc6,0x1c,0xed,0x52,0x52,0x59,0x86,0x83,0x4b,0xf7,0x39,0x84,0x5a};
    mont256_from_bytes(&ctx, minuend, minuend39);
    mont256_from_bytes(&ctx, subtrahend, subtrahend39);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference39, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend40[32]       = {0x84,0x76,0x8b,0x8c,0x54,0xdd,0x0b,0xa5,0x62,0x64,0x67,0xba,0x04,0xa1,0x05,0x47,0xb4,0x01,0xba,0x85,0x70,0xc1,0xdc,0xa1,0x75,0x6b,0x72,0x89,0x8d,0xd6,0x3c,0xb9};
    std::uint8_t subtrahend40[32]    = {0xeb,0x25,0xf8,0xa1,0xfc,0x2e,0x6a,0x59,0x1c,0xe3,0xbc,0x0c,0x10,0x75,0x5c,0x97,0xf5,0xf5,0x54,0xed,0x83,0x23,0x9e,0xf5,0x4b,0xa2,0xe1,0x61,0x9f,0xb9,0xaf,0x50};
    std::uint8_t difference40[32]    = {0x99,0x50,0x92,0xe9,0x58,0xae,0xa1,0x4c,0x45,0x80,0xab,0xad,0xf4,0x2b,0xa8,0xaf,0xbe,0x0c,0x65,0x96,0xed,0x9e,0x3d,0xad,0x29,0xc8,0x91,0x27,0xee,0x1c,0x8d,0x68};
    mont256_from_bytes(&ctx, minuend, minuend40);
    mont256_from_bytes(&ctx, subtrahend, subtrahend40);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference40, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend41[32]       = {0x45,0x9c,0x94,0x5c,0x43,0xfc,0x05,0x27,0x15,0x85,0x0a,0x03,0x1a,0xd2,0xd5,0xf1,0xe0,0x5b,0x3e,0x13,0xf8,0xc1,0x10,0xfb,0x3a,0x82,0x81,0x59,0xc9,0xd2,0x29,0x50};
    std::uint8_t subtrahend41[32]    = {0xd1,0xdc,0xec,0x53,0x21,0x2a,0x8d,0x9b,0xc1,0x7a,0x92,0x62,0x45,0x3b,0xf4,0x91,0x2e,0x7a,0x26,0xe9,0xc7,0x6c,0x60,0x3f,0xe7,0xe8,0xf9,0xf6,0x0a,0x22,0x73,0x85};
    std::uint8_t difference41[32]    = {0x73,0xbf,0xa8,0x08,0x22,0xd1,0x77,0x8b,0x54,0x0a,0x77,0xa0,0xd5,0x96,0xe1,0x60,0xb1,0xe1,0x17,0x29,0x31,0x54,0xb0,0xbc,0x52,0x99,0x87,0x63,0xbf,0xaf,0xb5,0xca};
    mont256_from_bytes(&ctx, minuend, minuend41);
    mont256_from_bytes(&ctx, subtrahend, subtrahend41);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference41, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend42[32]       = {0x67,0xec,0x32,0x6a,0x42,0x34,0x33,0x54,0xf2,0x2d,0x28,0x82,0xd1,0xa8,0x9b,0x37,0xad,0x0c,0x9b,0xb6,0xe9,0x52,0x6a,0x69,0xd9,0x7e,0x96,0x7b,0x6c,0x18,0xd9,0x82};
    std::uint8_t subtrahend42[32]    = {0x53,0xb9,0x73,0x77,0xb3,0x4e,0x8e,0xce,0x7e,0x9e,0xe5,0x1d,0x92,0x12,0x82,0x4c,0x83,0xc8,0xcb,0x28,0xeb,0x4e,0xd2,0xe3,0x89,0x5e,0x8b,0x6b,0x26,0x3c,0xfa,0x5e};
    std::uint8_t difference42[32]    = {0x14,0x32,0xbe,0xf2,0x8e,0xe5,0xa4,0x86,0x73,0x8e,0x43,0x65,0x3f,0x96,0x18,0xeb,0x29,0x43,0xd0,0x8d,0xfe,0x03,0x97,0x86,0x50,0x20,0x0b,0x10,0x45,0xdb,0xdf,0x24};
    mont256_from_bytes(&ctx, minuend, minuend42);
    mont256_from_bytes(&ctx, subtrahend, subtrahend42);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference42, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend43[32]       = {0xe5,0x31,0x69,0x60,0x6c,0xe1,0x93,0xc2,0x2e,0xef,0xa2,0x79,0xb0,0x2e,0x3d,0x8d,0xcc,0xb1,0xc5,0x1d,0x0e,0xba,0x0e,0xa8,0x47,0x70,0xa0,0x87,0x16,0xe6,0xfe,0xc3};
    std::uint8_t subtrahend43[32]    = {0x42,0xb3,0x87,0x55,0xcd,0x37,0x88,0x0e,0x16,0xac,0x41,0x91,0xa2,0x6a,0xa0,0xae,0x04,0x4f,0x15,0x74,0xf0,0x37,0xaf,0xc6,0x44,0xd8,0x2a,0x53,0x12,0x89,0xba,0xfa};
    std::uint8_t difference43[32]    = {0xa2,0x7d,0xe2,0x0a,0x9f,0xaa,0x0b,0xb4,0x18,0x43,0x60,0xe8,0x0d,0xc3,0x9c,0xdf,0xc8,0x62,0xaf,0xa8,0x1e,0x82,0x5e,0xe2,0x02,0x98,0x76,0x34,0x04,0x5d,0x43,0xc9};
    mont256_from_bytes(&ctx, minuend, minuend43);
    mont256_from_bytes(&ctx, subtrahend, subtrahend43);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference43, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend44[32]       = {0x1f,0x26,0x42,0xaa,0xdc,0xde,0xd2,0x04,0x43,0xb3,0x0f,0x66,0x11,0x0e,0x2c,0xb6,0x38,0xef,0xba,0xeb,0xdb,0x31,0xcc,0xd2,0x9b,0xb1,0x83,0xe1,0x15,0x70,0x26,0x6b};
    std::uint8_t subtrahend44[32]    = {0xea,0x59,0x67,0x9a,0xed,0x3a,0x32,0xa8,0x6a,0xf2,0x57,0x48,0x8d,0x95,0x9c,0x31,0xfe,0x8a,0xd4,0xa1,0x56,0xd2,0xa6,0x8c,0x02,0xf4,0xb3,0x42,0x74,0x2a,0x80,0x63};
    std::uint8_t difference44[32]    = {0x34,0xcc,0xdb,0x0e,0xef,0xa4,0x9f,0x5b,0xd8,0xc0,0xb8,0x1d,0x83,0x78,0x90,0x84,0x3a,0x64,0xe6,0x49,0x84,0x5f,0x26,0x47,0x98,0xbc,0xd0,0x9e,0xa1,0x45,0xa6,0x07};
    mont256_from_bytes(&ctx, minuend, minuend44);
    mont256_from_bytes(&ctx, subtrahend, subtrahend44);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference44, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend45[32]       = {0xf0,0x29,0x05,0x31,0x3d,0x0a,0x27,0x0b,0xb5,0xa4,0x32,0xcf,0x86,0xe3,0xe7,0x26,0x0b,0x0f,0x87,0x3b,0x21,0x14,0xe0,0x68,0x9f,0x27,0xf5,0x2c,0x44,0x92,0x74,0xd2};
    std::uint8_t subtrahend45[32]    = {0xee,0xa7,0xbb,0x64,0x33,0xa7,0x15,0x68,0x2e,0x5f,0x95,0x0c,0x0c,0xe5,0xaf,0x69,0x43,0x0b,0x91,0xed,0x29,0x54,0xba,0x5c,0xf8,0x1e,0x54,0xdd,0x1c,0x05,0x02,0xc6};
    std::uint8_t difference45[32]    = {0x01,0x81,0x49,0xcd,0x09,0x63,0x11,0xa3,0x87,0x44,0x9d,0xc3,0x79,0xfe,0x37,0xbc,0xc8,0x03,0xf5,0x4d,0xf7,0xc0,0x26,0x0b,0xa7,0x09,0xa0,0x4f,0x28,0x8d,0x72,0x0c};
    mont256_from_bytes(&ctx, minuend, minuend45);
    mont256_from_bytes(&ctx, subtrahend, subtrahend45);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference45, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend46[32]       = {0x72,0x18,0x88,0xff,0x4a,0x3a,0xdf,0x99,0x34,0xb3,0xff,0x60,0xc2,0x6e,0x7a,0x42,0x87,0xf5,0x3d,0xdd,0x4e,0x14,0xd5,0x71,0xa0,0xf0,0x96,0xda,0x4f,0xde,0xbb,0xec};
    std::uint8_t subtrahend46[32]    = {0xfe,0x97,0x7c,0x56,0x04,0xa6,0x56,0x51,0xcd,0xbd,0xe7,0x47,0x58,0xd5,0x0f,0x1b,0x45,0x40,0xf4,0x26,0x2d,0x8a,0xd8,0xc0,0xac,0x12,0x7e,0x93,0x80,0x05,0xce,0x74};
    std::uint8_t difference46[32]    = {0x73,0x81,0x0c,0xa8,0x45,0x94,0x89,0x47,0x66,0xf6,0x18,0x19,0x69,0x99,0x6b,0x27,0x42,0xb4,0x49,0xb6,0x20,0x89,0xfc,0xb1,0xf4,0xde,0x18,0x46,0xcf,0xd8,0xed,0x77};
    mont256_from_bytes(&ctx, minuend, minuend46);
    mont256_from_bytes(&ctx, subtrahend, subtrahend46);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference46, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend47[32]       = {0xfa,0x61,0x97,0x74,0x8d,0x11,0x8e,0x37,0x81,0x72,0x8a,0x07,0xbb,0xab,0x27,0xf6,0x04,0xb8,0x15,0x7d,0x03,0xed,0xb9,0x20,0x09,0x75,0x83,0x40,0x40,0x1d,0x68,0xfb};
    std::uint8_t subtrahend47[32]    = {0xa8,0x87,0xae,0x22,0x1b,0x35,0x41,0x1b,0x72,0x72,0x3b,0x9c,0xef,0x44,0xc0,0xd5,0x3e,0xe4,0xda,0x5a,0x79,0x89,0xe9,0xd0,0x83,0xa4,0xe6,0x29,0x30,0x80,0x38,0x89};
    std::uint8_t difference47[32]    = {0x51,0xd9,0xe9,0x52,0x71,0xdc,0x4d,0x1c,0x0f,0x00,0x4e,0x6a,0xcc,0x66,0x67,0x20,0xc5,0xd3,0x3b,0x22,0x8a,0x63,0xcf,0x4f,0x85,0xd0,0x9d,0x17,0x0f,0x9d,0x30,0x72};
    mont256_from_bytes(&ctx, minuend, minuend47);
    mont256_from_bytes(&ctx, subtrahend, subtrahend47);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference47, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend48[32]       = {0xe3,0x83,0x8b,0x9e,0xd5,0xa9,0x42,0x2a,0x8b,0xc0,0x83,0x11,0x7e,0xb8,0x6c,0x57,0xa8,0x11,0x00,0xa1,0x6e,0xa3,0x30,0xa1,0xa6,0x6d,0x58,0xb5,0xd1,0xa4,0xc0,0x1e};
    std::uint8_t subtrahend48[32]    = {0x3a,0xc4,0xda,0x9a,0xfb,0x81,0x39,0x21,0x37,0x16,0x1c,0x16,0xb0,0x0f,0xd7,0xbb,0x4e,0xca,0xde,0xa2,0x81,0xb6,0x2b,0xb5,0xf8,0x66,0x64,0xae,0x64,0xa1,0x49,0xf5};
    std::uint8_t difference48[32]    = {0xa8,0xbe,0xb1,0x03,0xda,0x28,0x09,0x09,0x54,0xaa,0x66,0xfa,0xce,0xa8,0x94,0x9c,0x59,0x46,0x21,0xfe,0xec,0xed,0x04,0xeb,0xae,0x06,0xf4,0x07,0x6d,0x03,0x76,0x29};
    mont256_from_bytes(&ctx, minuend, minuend48);
    mont256_from_bytes(&ctx, subtrahend, subtrahend48);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference48, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend49[32]       = {0x23,0xc4,0x9c,0xae,0xa2,0xcf,0x62,0xba,0xba,0x95,0x88,0x10,0xb4,0xeb,0xf4,0xb6,0xe1,0xc6,0x0a,0xa3,0xd5,0x10,0xbb,0x04,0x32,0xd9,0x0d,0xcd,0x57,0xbb,0x7d,0x97};
    std::uint8_t subtrahend49[32]    = {0x03,0xa6,0x39,0x66,0x21,0x3b,0xca,0x7f,0xd6,0x44,0xde,0x2f,0x0d,0xec,0x68,0x23,0xfb,0x5c,0x9d,0x56,0x58,0xf9,0x2d,0xea,0xfd,0x4b,0xd0,0x30,0x67,0x9a,0x44,0xdd};
    std::uint8_t difference49[32]    = {0x20,0x1e,0x63,0x48,0x81,0x93,0x98,0x3a,0xe4,0x50,0xa9,0xe1,0xa6,0xff,0x8c,0x92,0xe6,0x69,0x6d,0x4d,0x7c,0x17,0x8d,0x19,0x35,0x8d,0x3d,0x9c,0xf0,0x21,0x38,0xba};
    mont256_from_bytes(&ctx, minuend, minuend49);
    mont256_from_bytes(&ctx, subtrahend, subtrahend49);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference49, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend50[32]       = {0x0e,0x2e,0xc4,0x0a,0x29,0xca,0x86,0x2d,0x6e,0x45,0x05,0xf5,0x41,0x6e,0x99,0xb0,0xe1,0x3e,0x21,0x3e,0xbd,0xaa,0xea,0x00,0xa0,0x1d,0x61,0x6f,0x12,0x1a,0xe3,0xe6};
    std::uint8_t subtrahend50[32]    = {0xf8,0x8e,0xde,0x10,0xab,0xa8,0xb9,0xb3,0x81,0x85,0x79,0x7c,0xde,0xdb,0x91,0x09,0x61,0x81,0x77,0xff,0xd7,0x5d,0x67,0x69,0xaa,0x4c,0x5c,0x60,0x15,0xa0,0xcc,0xe6};
    std::uint8_t difference50[32]    = {0x15,0x9f,0xe5,0xf8,0x7e,0x21,0xcc,0x79,0xec,0xbf,0x8c,0x78,0x62,0x93,0x08,0xa7,0x7f,0xbc,0xa9,0x3d,0xe6,0x4d,0x82,0x97,0xf5,0xd1,0x05,0x0e,0xfc,0x7a,0x16,0xff};
    mont256_from_bytes(&ctx, minuend, minuend50);
    mont256_from_bytes(&ctx, subtrahend, subtrahend50);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference50, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend51[32]       = {0x2f,0x73,0x3b,0x05,0x75,0x9e,0xb5,0x59,0x0b,0x94,0xaf,0x3a,0x4b,0x05,0xe1,0xae,0xb1,0x53,0xd6,0x9c,0x3e,0x01,0xaa,0xa6,0x99,0x49,0x8a,0xc4,0x48,0x2c,0xc7,0x8e};
    std::uint8_t subtrahend51[32]    = {0x54,0x34,0x81,0x56,0xf6,0x37,0xa4,0x68,0x5d,0x38,0x5e,0x06,0x43,0x63,0xe5,0xd9,0x00,0xed,0x6b,0x02,0x72,0x21,0x8f,0xdc,0x44,0xdf,0x96,0xff,0x28,0x54,0x14,0x24};
    std::uint8_t difference51[32]    = {0xdb,0x3e,0xb9,0xad,0x7f,0x67,0x10,0xf0,0xae,0x5c,0x51,0x34,0x07,0xa1,0xfb,0xd5,0xb0,0x66,0x6b,0x98,0xcb,0xe0,0x1a,0xcb,0x54,0x69,0xf3,0xc5,0x1f,0xd8,0xb3,0x69};
    mont256_from_bytes(&ctx, minuend, minuend51);
    mont256_from_bytes(&ctx, subtrahend, subtrahend51);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference51, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend52[32]       = {0xe1,0xe4,0x37,0xb7,0xf7,0x35,0xef,0xe6,0x08,0xd1,0x80,0x11,0x3e,0x94,0x0b,0xb4,0x52,0xd3,0x1e,0x1b,0x8c,0x0d,0x00,0x33,0xfc,0x23,0x25,0xa9,0xf8,0xfd,0xd2,0x08};
    std::uint8_t subtrahend52[32]    = {0x15,0x79,0xda,0x0a,0x61,0xb2,0x48,0x0c,0x55,0xd8,0x5e,0x8d,0x00,0x46,0x0d,0x69,0x2e,0xd6,0x54,0x11,0x5b,0x49,0x15,0x61,0x37,0xc6,0x0e,0x98,0x4f,0x3e,0x88,0x5e};
    std::uint8_t difference52[32]    = {0xcc,0x6a,0x5d,0xad,0x95,0x83,0xa7,0xd9,0xb2,0xf9,0x21,0x84,0x3e,0x4d,0xfe,0x4b,0x23,0xfc,0xca,0x0a,0x30,0xc3,0xea,0xd2,0xc4,0x5d,0x17,0x11,0xa9,0xbf,0x49,0xaa};
    mont256_from_bytes(&ctx, minuend, minuend52);
    mont256_from_bytes(&ctx, subtrahend, subtrahend52);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference52, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend53[32]       = {0xc6,0xb7,0x89,0xef,0x81,0x36,0x5a,0xcc,0x3f,0x88,0xaf,0x59,0x33,0x73,0x6d,0xcc,0xa7,0xf0,0xc9,0x9e,0x80,0xb5,0x24,0x4a,0x47,0x67,0xe1,0xfa,0x79,0x82,0x3e,0xb2};
    std::uint8_t subtrahend53[32]    = {0x96,0x38,0x92,0xa7,0x66,0x46,0x5d,0x28,0x24,0xd4,0x58,0x9c,0x16,0xfa,0x14,0x21,0xd1,0x29,0xd0,0x67,0x43,0xa0,0x8f,0x06,0x17,0x42,0x0e,0x94,0x01,0x44,0x70,0x2b};
    std::uint8_t difference53[32]    = {0x30,0x7e,0xf7,0x48,0x1a,0xef,0xfd,0xa4,0x1a,0xb4,0x56,0xbd,0x1c,0x79,0x59,0xaa,0xd6,0xc6,0xf9,0x37,0x3d,0x14,0x95,0x44,0x30,0x25,0xd3,0x66,0x78,0x3d,0xce,0x87};
    mont256_from_bytes(&ctx, minuend, minuend53);
    mont256_from_bytes(&ctx, subtrahend, subtrahend53);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference53, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend54[32]       = {0x15,0xa0,0xa8,0xae,0x3b,0x99,0x68,0x70,0xa1,0x32,0x0b,0x9d,0x4d,0xe2,0xf8,0xad,0x4c,0xb5,0x9a,0xa7,0x05,0xc2,0x2d,0x3f,0x64,0xdb,0xc8,0xd3,0x0a,0xaa,0xaf,0x81};
    std::uint8_t subtrahend54[32]    = {0xe4,0x8e,0x9e,0x02,0xa8,0x54,0xc8,0x34,0x27,0xbe,0x9a,0xb1,0xc0,0x23,0x6e,0x49,0xda,0x6e,0x6d,0x8e,0x87,0x78,0xf7,0x42,0xf5,0x27,0xb5,0xc2,0x95,0xe8,0xc9,0x3e};
    std::uint8_t difference54[32]    = {0x31,0x12,0x0a,0xaa,0x93,0x44,0xa0,0x3c,0x79,0x73,0x70,0xeb,0x8d,0xbf,0x8a,0x63,0x72,0x47,0x2d,0x17,0x7e,0x49,0x35,0xfd,0x6f,0xb4,0x13,0x10,0x74,0xc1,0xe6,0x42};
    mont256_from_bytes(&ctx, minuend, minuend54);
    mont256_from_bytes(&ctx, subtrahend, subtrahend54);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference54, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend55[32]       = {0xb8,0x7e,0x4e,0x2b,0x53,0x7d,0x91,0x28,0xc3,0xa9,0xe8,0x89,0x63,0xb7,0x59,0xf5,0x98,0xb8,0x1c,0x66,0xe1,0x0c,0x16,0x7d,0xc8,0xb6,0xea,0xff,0xb7,0x4b,0x58,0x9b};
    std::uint8_t subtrahend55[32]    = {0x25,0x0e,0x7b,0x34,0xa4,0xaa,0x07,0xb4,0x9e,0x63,0x97,0xd4,0xb9,0x62,0x45,0xd3,0x48,0xbf,0xcb,0xcf,0x26,0x43,0x37,0x98,0x7e,0x83,0x49,0x04,0xfc,0x17,0x34,0x98};
    std::uint8_t difference55[32]    = {0x93,0x6f,0xd2,0xf6,0xae,0xd3,0x89,0x74,0x25,0x46,0x50,0xb4,0xaa,0x55,0x14,0x22,0x4f,0xf8,0x50,0x97,0xba,0xc8,0xde,0xe5,0x4a,0x33,0xa1,0xfa,0xbb,0x34,0x24,0x03};
    mont256_from_bytes(&ctx, minuend, minuend55);
    mont256_from_bytes(&ctx, subtrahend, subtrahend55);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference55, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend56[32]       = {0x6d,0xe2,0xfb,0x1f,0xa0,0x98,0xd6,0x91,0x83,0x52,0xbc,0x85,0xe4,0x56,0x55,0x9c,0xb7,0x0a,0xf5,0xf2,0xd5,0xd5,0x89,0x1f,0xd3,0x29,0xd6,0x5c,0x0b,0x35,0xb1,0xde};
    std::uint8_t subtrahend56[32]    = {0xc0,0xbb,0xe6,0xed,0x86,0x14,0xf5,0x04,0xe8,0xee,0x65,0xa1,0x23,0xa9,0xa9,0xda,0x81,0x6b,0x23,0x32,0xcf,0xed,0x94,0x3b,0xb3,0x78,0x3a,0x7c,0xbb,0xdd,0xbb,0x9b};
    std::uint8_t difference56[32]    = {0xad,0x27,0x14,0x31,0x1a,0x83,0xe1,0x8c,0x9a,0x64,0x56,0xe4,0xc0,0xac,0xab,0xc2,0x35,0x9f,0xd2,0xbf,0x05,0xe7,0xf4,0xe5,0x1f,0xb1,0x9b,0xdf,0x4f,0x57,0xf6,0x42};
    mont256_from_bytes(&ctx, minuend, minuend56);
    mont256_from_bytes(&ctx, subtrahend, subtrahend56);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference56, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend57[32]       = {0xaf,0xbc,0x9c,0xa9,0xd3,0x8f,0x8c,0x45,0x04,0x1d,0xcd,0x94,0xcd,0xff,0x5a,0x1c,0xd0,0x1a,0x91,0x4c,0xd5,0xbe,0x78,0x5a,0x91,0x87,0xdf,0x42,0x81,0x1e,0x76,0x16};
    std::uint8_t subtrahend57[32]    = {0xa4,0x94,0x6d,0x15,0xb1,0x7d,0xd2,0x55,0xf4,0xc1,0x82,0x26,0xae,0xd2,0x3b,0x0f,0xb6,0x10,0x4b,0x84,0xe4,0x90,0x7d,0x49,0xcc,0x47,0x93,0xd7,0x95,0x85,0x0e,0x21};
    std::uint8_t difference57[32]    = {0x0b,0x28,0x2f,0x94,0x22,0x11,0xb9,0xef,0x0f,0x5c,0x4b,0x6e,0x1f,0x2d,0x1f,0x0d,0x1a,0x0a,0x45,0xc7,0xf1,0x2d,0xfb,0x10,0xc5,0x40,0x4b,0x6a,0xeb,0x99,0x67,0xf5};
    mont256_from_bytes(&ctx, minuend, minuend57);
    mont256_from_bytes(&ctx, subtrahend, subtrahend57);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference57, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend58[32]       = {0xf5,0xa2,0xd8,0x79,0x5c,0x57,0x53,0x2b,0xa3,0x1a,0x49,0xdd,0x22,0x12,0x65,0x40,0x0a,0xb7,0x79,0x88,0x07,0xfa,0x22,0xf7,0x15,0xc8,0x91,0xff,0x3a,0xdd,0x65,0x27};
    std::uint8_t subtrahend58[32]    = {0x04,0xd2,0xbe,0x09,0xa0,0xb5,0x58,0x64,0x0c,0xff,0xf0,0x54,0x8e,0xfb,0xa4,0x42,0x73,0x8e,0x0b,0x77,0xd5,0xf8,0x60,0xc3,0x60,0x6a,0x0d,0xeb,0x1a,0xdb,0xce,0x5d};
    std::uint8_t difference58[32]    = {0xf0,0xd0,0x1a,0x6f,0xbb,0xa1,0xfa,0xc7,0x96,0x1a,0x59,0x88,0x93,0x16,0xc0,0xfd,0x97,0x29,0x6e,0x10,0x32,0x01,0xc2,0x33,0xb5,0x5e,0x84,0x14,0x20,0x01,0x96,0xca};
    mont256_from_bytes(&ctx, minuend, minuend58);
    mont256_from_bytes(&ctx, subtrahend, subtrahend58);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference58, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend59[32]       = {0x74,0xfa,0x94,0x12,0x00,0xd9,0x35,0x34,0x43,0x87,0xee,0x7b,0x7d,0x42,0x64,0x6f,0x3e,0x9b,0x76,0x8f,0xae,0x40,0x01,0xe3,0x88,0x0c,0xb4,0x01,0xa0,0x50,0x60,0x98};
    std::uint8_t subtrahend59[32]    = {0x17,0x89,0x81,0x9f,0x89,0x02,0xda,0xfc,0xe5,0xd9,0xfe,0x81,0x80,0xc2,0xb5,0xf1,0xee,0xb8,0x9f,0xf1,0xbf,0x8e,0x51,0xaa,0x11,0xf2,0xd4,0x4d,0xcc,0x35,0xe8,0x34};
    std::uint8_t difference59[32]    = {0x5d,0x71,0x12,0x72,0x77,0xd6,0x5a,0x37,0x5d,0xad,0xef,0xf9,0xfc,0x7f,0xae,0x7d,0x4f,0xe2,0xd6,0x9d,0xee,0xb1,0xb0,0x39,0x76,0x19,0xdf,0xb3,0xd4,0x1a,0x78,0x64};
    mont256_from_bytes(&ctx, minuend, minuend59);
    mont256_from_bytes(&ctx, subtrahend, subtrahend59);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference59, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend60[32]       = {0xcf,0x28,0xf6,0x5e,0x40,0x8f,0xc1,0x46,0x79,0x4e,0xc9,0x26,0xbc,0x9e,0x28,0xea,0xbe,0xe8,0x06,0x26,0x10,0xe8,0xad,0x01,0x86,0xa7,0x4a,0x63,0xa8,0xc7,0xd9,0xe0};
    std::uint8_t subtrahend60[32]    = {0x3b,0x11,0x85,0xd9,0x34,0x89,0x22,0xd7,0xc1,0xa6,0x24,0xdc,0xba,0xb5,0xb3,0x73,0x3c,0x1a,0xe9,0x17,0x43,0xfb,0x9f,0xbc,0xd8,0x9c,0x36,0xb2,0x13,0x0f,0x27,0xb2};
    std::uint8_t difference60[32]    = {0x94,0x17,0x70,0x85,0x0c,0x06,0x9e,0x6e,0xb7,0xa8,0xa4,0x4a,0x01,0xe8,0x75,0x77,0x82,0xcd,0x1d,0x0e,0xcc,0xed,0x0d,0x44,0xae,0x0b,0x13,0xb1,0x95,0xb8,0xb2,0x2e};
    mont256_from_bytes(&ctx, minuend, minuend60);
    mont256_from_bytes(&ctx, subtrahend, subtrahend60);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference60, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend61[32]       = {0x13,0xa5,0x39,0x7f,0x61,0xef,0x7b,0xd1,0xd8,0x74,0xbc,0x79,0x7e,0x73,0x6d,0x5f,0x75,0xd8,0xd8,0xa4,0xf9,0xc9,0xc6,0x79,0xa6,0x61,0xf6,0x2c,0xbd,0x65,0x68,0x0c};
    std::uint8_t subtrahend61[32]    = {0xa1,0xfe,0xb6,0x24,0x9d,0xf2,0x02,0x5f,0x0b,0xf7,0xa4,0xbd,0xc4,0x58,0x27,0x2f,0x49,0x8d,0xbf,0xa8,0xaf,0x06,0xbc,0xf7,0xe9,0x14,0x57,0xdb,0x7a,0xa0,0x68,0xf1};
    std::uint8_t difference61[32]    = {0x71,0xa6,0x83,0x59,0xc3,0xfd,0x79,0x72,0xcc,0x7d,0x17,0xbb,0xba,0x1b,0x46,0x30,0x2c,0x4b,0x18,0xfb,0x4a,0xc3,0x09,0x82,0xbd,0x4d,0x9e,0x51,0x42,0xc4,0xff,0x1a};
    mont256_from_bytes(&ctx, minuend, minuend61);
    mont256_from_bytes(&ctx, subtrahend, subtrahend61);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference61, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend62[32]       = {0xa6,0xca,0xf4,0xa3,0x41,0x02,0x3a,0xed,0x54,0xef,0x12,0x5a,0x25,0xbd,0xa6,0x59,0x99,0x86,0x48,0xe0,0x13,0xd5,0x31,0x6f,0x32,0xc3,0x24,0x44,0xa4,0x8c,0x1d,0x5c};
    std::uint8_t subtrahend62[32]    = {0x7b,0x7f,0xec,0x4b,0x03,0x31,0x2e,0xad,0x22,0x29,0x30,0xae,0x91,0x58,0xd4,0xa8,0x9f,0x03,0xbc,0x5a,0x4d,0xee,0x48,0x12,0xb1,0x61,0x07,0xf1,0xbe,0x43,0x7c,0x7b};
    std::uint8_t difference62[32]    = {0x2b,0x4b,0x08,0x58,0x3d,0xd1,0x0c,0x40,0x32,0xc5,0xe1,0xab,0x94,0x64,0xd1,0xb0,0xfa,0x82,0x8c,0x85,0xc5,0xe6,0xe9,0x5c,0x81,0x62,0x1c,0x52,0xe6,0x48,0xa0,0xe1};
    mont256_from_bytes(&ctx, minuend, minuend62);
    mont256_from_bytes(&ctx, subtrahend, subtrahend62);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference62, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend63[32]       = {0x37,0xba,0xc2,0x33,0xb1,0x33,0x0c,0x3f,0x19,0x7a,0x14,0xe2,0xac,0x08,0x4b,0xa5,0xf8,0xf6,0x59,0xac,0x44,0xce,0x4a,0xb3,0x7c,0x5d,0x42,0xdc,0x0f,0x87,0x7a,0xe3};
    std::uint8_t subtrahend63[32]    = {0x77,0x45,0x10,0xca,0x76,0xf4,0x25,0x1e,0x49,0x19,0x61,0xa1,0x84,0x3b,0xae,0xe9,0xb5,0x78,0x90,0x9c,0x4a,0x75,0x91,0xf2,0x7d,0x57,0x5d,0x17,0xac,0xfb,0x2d,0x5e};
    std::uint8_t difference63[32]    = {0xc0,0x75,0xb1,0x68,0x3a,0x3e,0xe7,0x20,0xd0,0x60,0xb3,0x41,0x27,0xcc,0x9c,0xbc,0x43,0x7d,0xc9,0x0e,0xfa,0x58,0xb8,0xc1,0xff,0x05,0xe5,0xc4,0x62,0x8c,0x4d,0x84};
    mont256_from_bytes(&ctx, minuend, minuend63);
    mont256_from_bytes(&ctx, subtrahend, subtrahend63);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference63, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend64[32]       = {0x4f,0xc9,0xe9,0x18,0x33,0x02,0x0c,0xcd,0x8c,0x90,0x47,0x3e,0xe4,0xc7,0x17,0xfd,0xfe,0x48,0xef,0x63,0x1e,0x56,0x34,0x08,0xc4,0x65,0x3c,0xde,0x77,0x62,0x00,0xb5};
    std::uint8_t subtrahend64[32]    = {0x13,0x93,0x29,0x04,0x75,0x7f,0x1c,0xba,0x4a,0x22,0x7f,0x39,0x04,0x7b,0x2c,0x10,0x79,0x12,0xef,0x4a,0xef,0xae,0x5d,0x4e,0x15,0xfa,0x8b,0x65,0xfa,0x66,0x72,0xcd};
    std::uint8_t difference64[32]    = {0x3c,0x36,0xc0,0x13,0xbd,0x82,0xf0,0x13,0x42,0x6d,0xc8,0x05,0xe0,0x4b,0xeb,0xed,0x85,0x36,0x00,0x18,0x2e,0xa7,0xd6,0xba,0xae,0x6a,0xb1,0x78,0x7c,0xfb,0x8d,0xe8};
    mont256_from_bytes(&ctx, minuend, minuend64);
    mont256_from_bytes(&ctx, subtrahend, subtrahend64);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference64, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend65[32]       = {0x63,0x08,0x7e,0x52,0x44,0xc6,0xb8,0x95,0xfe,0x74,0x9e,0x67,0x73,0x0f,0x37,0xf1,0xfe,0x9e,0xb4,0xad,0xf7,0xd5,0xf1,0x24,0x81,0xb1,0xc0,0x25,0xd1,0xe4,0xd0,0xa3};
    std::uint8_t subtrahend65[32]    = {0x17,0x1e,0x1a,0x8c,0x94,0xdb,0x5f,0x8f,0x13,0x19,0xd4,0x24,0x35,0xf1,0x03,0x00,0xee,0x37,0x9c,0x65,0xf2,0x12,0x01,0xe4,0xea,0xa3,0x55,0x6c,0x35,0xb7,0xe4,0x48};
    std::uint8_t difference65[32]    = {0x4b,0xea,0x63,0xc5,0xaf,0xeb,0x59,0x06,0xeb,0x5a,0xca,0x43,0x3d,0x1e,0x34,0xf1,0x10,0x67,0x18,0x48,0x05,0xc3,0xef,0x3f,0x97,0x0e,0x6a,0xb9,0x9c,0x2c,0xec,0x5b};
    mont256_from_bytes(&ctx, minuend, minuend65);
    mont256_from_bytes(&ctx, subtrahend, subtrahend65);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference65, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend66[32]       = {0x9a,0x76,0x2d,0x54,0x21,0xf2,0x67,0xe2,0x5c,0x0b,0xb4,0x0f,0xf3,0xe6,0xca,0x73,0x43,0x05,0xe9,0x86,0x86,0x29,0x2b,0xb5,0xbf,0x5b,0x41,0x1b,0x24,0x49,0x1d,0xf6};
    std::uint8_t subtrahend66[32]    = {0x5d,0x7c,0xfe,0xd1,0xb4,0x0d,0xe5,0x6d,0x1c,0xd8,0x6f,0xc1,0xe3,0x09,0x66,0x19,0x47,0x91,0xc2,0xe9,0x82,0x3d,0x11,0xed,0xa1,0xb5,0x01,0xd6,0xd1,0xf9,0xbd,0xfe};
    std::uint8_t difference66[32]    = {0x3c,0xf9,0x2e,0x82,0x6d,0xe4,0x82,0x75,0x3f,0x33,0x44,0x4e,0x10,0xdd,0x64,0x59,0xfb,0x74,0x26,0x9d,0x03,0xec,0x19,0xc8,0x1d,0xa6,0x3f,0x44,0x52,0x4f,0x5f,0xf8};
    mont256_from_bytes(&ctx, minuend, minuend66);
    mont256_from_bytes(&ctx, subtrahend, subtrahend66);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference66, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend67[32]       = {0x28,0xb8,0x80,0x73,0x06,0x5b,0x8c,0x35,0x64,0xe2,0x76,0x02,0x7c,0x73,0xb6,0xc9,0xe0,0x4b,0x0d,0xce,0xe5,0xd0,0x0a,0x4d,0x7f,0x75,0x95,0xb5,0x3b,0x3b,0xf4,0xbf};
    std::uint8_t subtrahend67[32]    = {0xba,0x28,0xa6,0x79,0x4d,0x4c,0xa9,0xc7,0x67,0xc9,0x8f,0xb9,0x73,0x65,0x06,0xec,0xae,0x7c,0x8f,0x09,0x7d,0xdf,0xcb,0xc9,0xf3,0x30,0x8c,0xe5,0x00,0xeb,0x4e,0x11};
    std::uint8_t difference67[32]    = {0x6e,0x8f,0xd9,0xf8,0xb9,0x0e,0xe2,0x6d,0xfd,0x18,0xe6,0x49,0x09,0x0e,0xaf,0xdd,0x31,0xce,0x7e,0xc4,0x67,0xf0,0x3e,0x84,0x8c,0x45,0x08,0xd0,0x3a,0x50,0xa6,0xad};
    mont256_from_bytes(&ctx, minuend, minuend67);
    mont256_from_bytes(&ctx, subtrahend, subtrahend67);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference67, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend68[32]       = {0x54,0xd1,0xac,0x6b,0xd7,0x19,0x61,0x89,0x1e,0xf3,0xea,0x44,0x50,0xea,0x7d,0xa7,0x60,0x48,0x7e,0x15,0x58,0x0d,0xc5,0xab,0x6a,0x8a,0xd9,0xcb,0x24,0x05,0x63,0x60};
    std::uint8_t subtrahend68[32]    = {0xf0,0x9c,0x0a,0xfb,0x1e,0xbb,0x07,0x94,0x65,0xf4,0x56,0xaa,0xd6,0xcf,0xf7,0x18,0x56,0x99,0x08,0xf6,0xc0,0x30,0x1b,0x21,0x53,0x15,0x8c,0xe4,0x00,0x72,0x1f,0x84};
    std::uint8_t difference68[32]    = {0x64,0x35,0xa1,0x6f,0xb8,0x5e,0x59,0xf4,0xb8,0xff,0x93,0x99,0x7a,0x1a,0x86,0x8f,0x09,0xaf,0x75,0x1d,0x97,0xdd,0xaa,0x8b,0x17,0x75,0x4c,0xe7,0x23,0x93,0x43,0xdb};
    mont256_from_bytes(&ctx, minuend, minuend68);
    mont256_from_bytes(&ctx, subtrahend, subtrahend68);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference68, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend69[32]       = {0x40,0xd2,0x84,0x06,0x4a,0x32,0x7e,0x2d,0xbd,0x6a,0x99,0x6d,0xe6,0xcd,0x10,0xf1,0x03,0x00,0x30,0x05,0xb6,0x88,0xb6,0x61,0x32,0x1c,0x17,0x44,0xed,0x28,0x79,0xc1};
    std::uint8_t subtrahend69[32]    = {0x13,0x8e,0xfe,0xf9,0x96,0xd4,0x48,0x0f,0xde,0xb6,0x7a,0xe7,0xff,0xb0,0xdd,0x9e,0x63,0xe1,0x98,0x69,0x64,0x95,0x0d,0xc2,0x10,0xa2,0x5b,0x19,0x5f,0x49,0xf0,0xfc};
    std::uint8_t difference69[32]    = {0x2d,0x43,0x85,0x0c,0xb3,0x5e,0x36,0x1d,0xde,0xb4,0x1e,0x85,0xe7,0x1c,0x33,0x52,0x9f,0x1e,0x97,0x9c,0x51,0xf3,0xa8,0x9f,0x21,0x79,0xbc,0x2b,0x8d,0xde,0x88,0xc5};
    mont256_from_bytes(&ctx, minuend, minuend69);
    mont256_from_bytes(&ctx, subtrahend, subtrahend69);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference69, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend70[32]       = {0x47,0xd7,0xdf,0x79,0x0c,0x5b,0x4c,0x59,0xda,0xb0,0x79,0x29,0x46,0x70,0x93,0x12,0xc1,0x72,0xb2,0x98,0x6d,0x94,0xdd,0x6d,0xec,0xe8,0x07,0x99,0x5c,0x57,0x72,0x2e};
    std::uint8_t subtrahend70[32]    = {0x26,0x1f,0x40,0xdf,0xef,0x82,0xd1,0xa3,0xa2,0x8c,0xf7,0xb1,0x49,0x1e,0x99,0xf5,0xa9,0x77,0x66,0xfb,0xd5,0xad,0x53,0x60,0x0d,0x36,0xce,0x2c,0x1a,0x09,0xa8,0x40};
    std::uint8_t difference70[32]    = {0x21,0xb8,0x9e,0x99,0x1c,0xd8,0x7a,0xb6,0x38,0x23,0x81,0x77,0xfd,0x51,0xf9,0x1d,0x17,0xfb,0x4b,0x9c,0x97,0xe7,0x8a,0x0d,0xdf,0xb1,0x39,0x6d,0x42,0x4d,0xc9,0xee};
    mont256_from_bytes(&ctx, minuend, minuend70);
    mont256_from_bytes(&ctx, subtrahend, subtrahend70);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference70, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend71[32]       = {0xc5,0xef,0x5c,0xfb,0x30,0x99,0xf2,0x71,0x50,0xcb,0x40,0x7a,0x82,0xce,0x78,0x6f,0x6f,0xad,0x79,0x36,0x44,0x06,0xc0,0x53,0xf8,0x95,0xfc,0x55,0x3f,0xd3,0xbe,0x98};
    std::uint8_t subtrahend71[32]    = {0xc2,0xfb,0xd8,0xa3,0xcf,0xdc,0xc2,0x57,0x07,0x6d,0x49,0x0a,0xe2,0x5f,0x4b,0x1c,0x6d,0x80,0xde,0x7c,0xf4,0xc7,0x3f,0x2b,0xc8,0xff,0x1c,0x38,0x5f,0x93,0xd1,0x80};
    std::uint8_t difference71[32]    = {0x02,0xf3,0x84,0x57,0x60,0xbd,0x30,0x1a,0x49,0x5d,0xf7,0x6f,0xa0,0x6f,0x2d,0x53,0x02,0x2c,0x9a,0xb9,0x4f,0x3f,0x81,0x28,0x2f,0x96,0xe0,0x1c,0xe0,0x3f,0xed,0x18};
    mont256_from_bytes(&ctx, minuend, minuend71);
    mont256_from_bytes(&ctx, subtrahend, subtrahend71);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference71, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend72[32]       = {0x34,0x14,0x5e,0x87,0x8c,0x9a,0x37,0x51,0x8d,0xdc,0xf8,0x3c,0xf0,0xd1,0xab,0x56,0xe0,0x2f,0x9a,0x72,0xe9,0xd6,0x25,0xc9,0x66,0x69,0x21,0x58,0xa1,0x82,0x63,0x27};
    std::uint8_t subtrahend72[32]    = {0x9d,0x6b,0x02,0x3f,0x73,0x6b,0x96,0xa0,0x69,0x2f,0xd3,0x60,0xbb,0x7b,0x73,0x8e,0xee,0xf7,0x95,0xcd,0x0c,0xaa,0x76,0x12,0x14,0xa0,0xb0,0x0b,0xb8,0x35,0xe8,0xa5};
    std::uint8_t difference72[32]    = {0x96,0xa9,0x5c,0x47,0x19,0x2e,0xa0,0xb1,0x24,0xad,0x24,0xdc,0x35,0x56,0x37,0xc7,0xf1,0x38,0x04,0xa4,0xdd,0x2b,0xaf,0xb8,0x51,0xc8,0x71,0x4c,0xe9,0x4c,0x7a,0x81};
    mont256_from_bytes(&ctx, minuend, minuend72);
    mont256_from_bytes(&ctx, subtrahend, subtrahend72);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference72, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend73[32]       = {0xe9,0x72,0x9f,0x3f,0x0c,0x89,0xc0,0x01,0x7c,0x4e,0xa6,0x03,0x49,0x44,0xf2,0xce,0xde,0x96,0x2a,0x6d,0xa4,0xfd,0x57,0xc5,0x23,0x79,0x7d,0x45,0xc0,0xae,0xd9,0xc5};
    std::uint8_t subtrahend73[32]    = {0x48,0x20,0x82,0x31,0x57,0xfa,0x49,0xe5,0x6a,0x34,0xb3,0x71,0x78,0xe1,0x0e,0x70,0x2b,0xb7,0x1c,0x68,0x20,0x97,0x79,0x8c,0x8c,0xd3,0xe4,0x18,0xed,0x41,0x42,0xba};
    std::uint8_t difference73[32]    = {0xa1,0x52,0x1d,0x0d,0xb4,0x8f,0x76,0x1c,0x12,0x19,0xf2,0x91,0xd0,0x63,0xe4,0x5e,0xb2,0xdf,0x0e,0x05,0x84,0x65,0xde,0x38,0x96,0xa5,0x99,0x2c,0xd3,0x6d,0x97,0x0b};
    mont256_from_bytes(&ctx, minuend, minuend73);
    mont256_from_bytes(&ctx, subtrahend, subtrahend73);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference73, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend74[32]       = {0x67,0xfd,0x54,0x99,0x42,0x9a,0x70,0x79,0xa7,0x1f,0x11,0xb2,0xf9,0xee,0x8b,0xc8,0xbd,0x1e,0x69,0x12,0xbd,0x31,0x3b,0xee,0x41,0x78,0x5b,0xc6,0x4c,0x3a,0xc6,0xfc};
    std::uint8_t subtrahend74[32]    = {0x1e,0xa7,0x72,0x28,0x64,0xf5,0x49,0x69,0xab,0x3b,0x74,0xfe,0x8e,0xac,0xa2,0x88,0x7b,0xb1,0xd1,0x24,0x4d,0x03,0x9b,0x72,0x3d,0x19,0x26,0xac,0xa7,0xef,0x4f,0x5d};
    std::uint8_t difference74[32]    = {0x49,0x55,0xe2,0x70,0xdd,0xa5,0x27,0x0f,0xfb,0xe3,0x9c,0xb4,0x6b,0x41,0xe9,0x40,0x41,0x6c,0x97,0xee,0x70,0x2d,0xa0,0x7c,0x04,0x5f,0x35,0x19,0xa4,0x4b,0x77,0x9f};
    mont256_from_bytes(&ctx, minuend, minuend74);
    mont256_from_bytes(&ctx, subtrahend, subtrahend74);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference74, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend75[32]       = {0xcf,0xd3,0xdd,0x72,0xe7,0xec,0xfd,0x0c,0x80,0x27,0xa2,0xa2,0x35,0x37,0x22,0x35,0x13,0x3e,0x61,0x53,0x29,0x62,0x59,0xc8,0xa4,0xa9,0x15,0xd0,0x2a,0xd6,0x4c,0xe9};
    std::uint8_t subtrahend75[32]    = {0xc2,0x5e,0x11,0x4f,0xff,0x18,0xfe,0x33,0x55,0x34,0xa0,0x34,0xe8,0x00,0x9d,0x90,0x73,0xf6,0xe5,0x3d,0x38,0x53,0x93,0x3d,0x8c,0xe6,0x21,0xef,0x7f,0x40,0x5b,0xc8};
    std::uint8_t difference75[32]    = {0x0d,0x75,0xcc,0x22,0xe8,0xd3,0xfe,0xd9,0x2a,0xf3,0x02,0x6d,0x4d,0x36,0x84,0xa4,0x9f,0x47,0x7c,0x15,0xf1,0x0e,0xc6,0x8b,0x17,0xc2,0xf3,0xe0,0xab,0x95,0xf1,0x21};
    mont256_from_bytes(&ctx, minuend, minuend75);
    mont256_from_bytes(&ctx, subtrahend, subtrahend75);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference75, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend76[32]       = {0x2c,0xb8,0xd1,0x4c,0x17,0x39,0x10,0xe3,0x3e,0x7c,0x65,0x67,0x31,0x41,0x97,0x75,0x8c,0x3b,0xa8,0x59,0x23,0xbc,0x91,0x52,0x6d,0x6b,0x98,0x7a,0x73,0x30,0x9b,0x95};
    std::uint8_t subtrahend76[32]    = {0xcf,0x32,0x1d,0x63,0x42,0x23,0xb8,0xaa,0x5e,0x49,0x42,0x2a,0x3d,0x37,0x66,0x42,0x51,0xbc,0xd7,0x7a,0x17,0x51,0xf5,0x79,0x8e,0x4d,0xc3,0xa3,0x57,0x8a,0x60,0xd8};
    std::uint8_t difference76[32]    = {0x5d,0x86,0xb3,0xe7,0xd5,0x15,0x58,0x38,0xe0,0x33,0x23,0x3c,0xf4,0x0a,0x31,0x33,0x3a,0x7e,0xd0,0xde,0x0c,0x6a,0x9b,0xd9,0xdf,0x1d,0xd4,0xd7,0x1b,0xa6,0x3a,0xbc};
    mont256_from_bytes(&ctx, minuend, minuend76);
    mont256_from_bytes(&ctx, subtrahend, subtrahend76);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference76, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend77[32]       = {0x62,0x01,0xa9,0xd3,0x69,0xac,0x0f,0x03,0xde,0xe0,0xa8,0x43,0xbf,0xe9,0x8f,0x8c,0x05,0x24,0x13,0x7f,0xe3,0x22,0xe9,0x6d,0x33,0xbf,0x91,0x57,0x91,0xd2,0x77,0xf2};
    std::uint8_t subtrahend77[32]    = {0xc0,0x8a,0x58,0xd7,0x56,0x94,0x7a,0x7a,0x45,0x2e,0x70,0x4d,0x60,0x7a,0x47,0x32,0x35,0xc2,0xe2,0x29,0x86,0x2f,0xe2,0x31,0xbe,0xef,0x67,0xfb,0x69,0xf4,0x46,0x12};
    std::uint8_t difference77[32]    = {0xa1,0x77,0x50,0xfb,0x13,0x17,0x94,0x89,0x99,0xb2,0x37,0xf6,0x5f,0x6f,0x48,0x59,0xcf,0x61,0x31,0x55,0x5c,0xf3,0x07,0x3c,0x74,0xd0,0x29,0x5c,0x27,0xde,0x31,0xdf};
    mont256_from_bytes(&ctx, minuend, minuend77);
    mont256_from_bytes(&ctx, subtrahend, subtrahend77);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference77, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend78[32]       = {0xaf,0xcf,0x0e,0x77,0x20,0x39,0x43,0xf6,0x5c,0x32,0x7a,0x6d,0xf7,0xba,0x38,0xb6,0x93,0x04,0x10,0x6e,0x47,0x0b,0x4f,0xad,0x7f,0x86,0x7d,0x5f,0x0f,0xe3,0x21,0xec};
    std::uint8_t subtrahend78[32]    = {0x17,0xb4,0x83,0x4c,0x37,0x49,0x5c,0x5e,0xd9,0x3f,0xf7,0x16,0xdc,0xe4,0x7b,0x21,0xca,0x51,0xe1,0x52,0xa1,0x2f,0x3a,0x94,0x87,0x7b,0x55,0xcb,0x80,0xde,0x8b,0x3e};
    std::uint8_t difference78[32]    = {0x98,0x1a,0x8b,0x2a,0xe8,0xef,0xe7,0x97,0x82,0xf2,0x83,0x57,0x1a,0xd5,0xbd,0x94,0xc8,0xb2,0x2f,0x1b,0xa5,0xdc,0x15,0x18,0xf8,0x0b,0x27,0x93,0x8f,0x04,0x96,0xae};
    mont256_from_bytes(&ctx, minuend, minuend78);
    mont256_from_bytes(&ctx, subtrahend, subtrahend78);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference78, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend79[32]       = {0x6e,0x8c,0xd9,0x4e,0x72,0x23,0xc6,0x8a,0xa5,0x52,0x9b,0x05,0x66,0x56,0x7b,0xc4,0x62,0x72,0x92,0xf8,0x3f,0x9a,0xa8,0x84,0xe5,0x94,0x09,0xc1,0x45,0x61,0x9f,0xc0};
    std::uint8_t subtrahend79[32]    = {0x20,0x93,0x42,0xca,0x05,0x95,0x5f,0xb9,0xf7,0xd1,0x7e,0xbd,0xdf,0x75,0xc8,0x83,0xd0,0x78,0x84,0xb7,0xd9,0x43,0x55,0x41,0x4f,0xe0,0x48,0x02,0xf4,0x35,0xa5,0x73};
    std::uint8_t difference79[32]    = {0x4d,0xf9,0x96,0x84,0x6c,0x8e,0x66,0xd0,0xad,0x81,0x1c,0x47,0x86,0xe0,0xb3,0x40,0x91,0xfa,0x0e,0x40,0x66,0x57,0x53,0x43,0x95,0xb3,0xc1,0xbe,0x51,0x2b,0xfa,0x4d};
    mont256_from_bytes(&ctx, minuend, minuend79);
    mont256_from_bytes(&ctx, subtrahend, subtrahend79);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference79, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend80[32]       = {0xf7,0xe1,0x47,0xfd,0x79,0x28,0x1c,0x19,0xcd,0xe3,0x47,0xab,0xe5,0x4c,0x5d,0xe6,0xc3,0x81,0x3c,0xe6,0xb5,0xa2,0x90,0x61,0x6c,0xd9,0xe6,0x2a,0x08,0x41,0x1c,0x07};
    std::uint8_t subtrahend80[32]    = {0xed,0x9b,0xf0,0xb6,0xed,0x44,0x8d,0x4e,0xee,0x24,0x1c,0x43,0x64,0x3a,0xb9,0xe2,0x12,0xb9,0x2a,0x01,0x00,0x0b,0xb5,0xf9,0x7d,0x65,0x21,0x35,0x96,0x51,0x32,0xd6};
    std::uint8_t difference80[32]    = {0x0a,0x45,0x57,0x46,0x8b,0xe3,0x8e,0xca,0xdf,0xbf,0x2b,0x68,0x81,0x11,0xa4,0x04,0xb0,0xc8,0x12,0xe5,0xb5,0x96,0xda,0x67,0xef,0x74,0xc4,0xf4,0x71,0xef,0xe9,0x31};
    mont256_from_bytes(&ctx, minuend, minuend80);
    mont256_from_bytes(&ctx, subtrahend, subtrahend80);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference80, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend81[32]       = {0xc8,0x79,0xb6,0x63,0x3f,0x9b,0x6b,0xb2,0x72,0xee,0x6a,0x2e,0xf8,0xe4,0xcb,0x5c,0x77,0xd8,0xc5,0x69,0xda,0xff,0x9a,0x0b,0x87,0x21,0xec,0xf8,0xd3,0x59,0xd0,0x7a};
    std::uint8_t subtrahend81[32]    = {0x1b,0xe0,0x3d,0xf0,0xae,0x9c,0x78,0xbd,0xf8,0xcd,0x9e,0xc3,0x85,0xb9,0xc0,0x9a,0x26,0xed,0xf1,0xbd,0x27,0x85,0x57,0x98,0x39,0x4a,0xfb,0xe9,0x1b,0xea,0x70,0x5e};
    std::uint8_t difference81[32]    = {0xac,0x99,0x78,0x72,0x90,0xfe,0xf2,0xf4,0x7a,0x20,0xcb,0x6b,0x73,0x2b,0x0a,0xc2,0x50,0xea,0xd3,0xac,0xb3,0x7a,0x42,0x73,0x4d,0xd6,0xf1,0x0f,0xb7,0x6f,0x60,0x1c};
    mont256_from_bytes(&ctx, minuend, minuend81);
    mont256_from_bytes(&ctx, subtrahend, subtrahend81);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference81, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend82[32]       = {0xe5,0x17,0x4e,0xbd,0xc3,0xc9,0xf7,0xe3,0xd8,0xb4,0xc8,0x31,0xa5,0xb8,0x9b,0x2f,0xb3,0x74,0xfa,0xb6,0xb8,0xc3,0xa4,0xd2,0xd3,0x4d,0x1c,0x0d,0xf1,0x05,0x86,0x67};
    std::uint8_t subtrahend82[32]    = {0x20,0x2a,0xb6,0xfa,0xc8,0x44,0xb8,0xfd,0x00,0x59,0x86,0x5a,0x0a,0x1f,0xb4,0x3b,0xc6,0xe0,0x67,0x3a,0x8d,0x2f,0x29,0xe7,0x15,0xc2,0xc8,0x1a,0x75,0x13,0x41,0x07};
    std::uint8_t difference82[32]    = {0xc4,0xec,0x97,0xc2,0xfb,0x85,0x3e,0xe6,0xd8,0x5b,0x41,0xd7,0x9b,0x98,0xe6,0xf3,0xec,0x94,0x93,0x7c,0x2b,0x94,0x7a,0xeb,0xbd,0x8a,0x53,0xf3,0x7b,0xf2,0x45,0x60};
    mont256_from_bytes(&ctx, minuend, minuend82);
    mont256_from_bytes(&ctx, subtrahend, subtrahend82);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference82, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend83[32]       = {0xf6,0x62,0x22,0x2e,0x4d,0xc4,0xac,0x8c,0xb7,0x0b,0xa8,0x58,0xa5,0x3f,0xdd,0xc9,0x09,0x9f,0x9c,0x9f,0xeb,0x7f,0xe2,0x6b,0x91,0xc3,0x09,0x8c,0x3b,0x8a,0x27,0xba};
    std::uint8_t subtrahend83[32]    = {0xc3,0x8b,0x48,0xa2,0xb2,0xd6,0x43,0xa2,0x6f,0xfb,0x72,0x6a,0xa2,0xe3,0xf9,0x3a,0x87,0x3b,0x99,0x03,0x40,0x75,0x91,0x6e,0xa0,0x60,0x84,0x6c,0x20,0xc2,0x6f,0x71};
    std::uint8_t difference83[32]    = {0x32,0xd6,0xd9,0x8b,0x9a,0xee,0x68,0xea,0x47,0x10,0x35,0xee,0x02,0x5b,0xe4,0x8e,0x82,0x64,0x03,0x9c,0xab,0x0a,0x50,0xfc,0xf1,0x62,0x85,0x20,0x1a,0xc7,0xb8,0x49};
    mont256_from_bytes(&ctx, minuend, minuend83);
    mont256_from_bytes(&ctx, subtrahend, subtrahend83);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference83, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend84[32]       = {0x31,0x13,0x5d,0xe9,0x95,0x38,0x57,0xd7,0xf1,0x8b,0xde,0x0e,0x86,0x41,0x7b,0x60,0x4c,0xe3,0xb0,0xcc,0x12,0x02,0x95,0x2f,0x19,0x75,0x36,0xb1,0x1c,0xb4,0xba,0x55};
    std::uint8_t subtrahend84[32]    = {0x89,0x98,0x0c,0x50,0x02,0xad,0x9d,0x2b,0x00,0x4b,0x7f,0xd0,0x99,0xdf,0x20,0x9b,0xca,0x5d,0x5e,0x7d,0x39,0x3c,0xbc,0xdd,0x42,0xc9,0x27,0xb9,0x63,0x59,0x56,0xbe};
    std::uint8_t difference84[32]    = {0xa7,0x7b,0x51,0x98,0x92,0x8a,0xba,0xac,0xf1,0x40,0x5e,0x3d,0xec,0x62,0x5a,0xc4,0x82,0x86,0x52,0x4d,0xd8,0xc5,0xd8,0x52,0xd6,0xac,0x0e,0xf7,0xb9,0x5b,0x63,0x96};
    mont256_from_bytes(&ctx, minuend, minuend84);
    mont256_from_bytes(&ctx, subtrahend, subtrahend84);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference84, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend85[32]       = {0xd6,0xe3,0xa7,0x1e,0xa5,0x02,0xe8,0xa8,0x50,0xfc,0xc6,0x26,0xf5,0x7d,0x17,0x09,0x47,0x52,0x91,0x94,0x75,0xef,0xd2,0x33,0xff,0x12,0x5e,0xb4,0x4d,0x30,0x7f,0xe4};
    std::uint8_t subtrahend85[32]    = {0x07,0x7e,0xf3,0x2a,0x3f,0x3f,0x37,0xea,0x8c,0x08,0x56,0xa4,0x3c,0x19,0xc3,0x15,0x86,0xba,0x22,0xdd,0x79,0xad,0x89,0x99,0x3e,0x0b,0x25,0xcd,0xe2,0x3f,0x03,0xcc};
    std::uint8_t difference85[32]    = {0xcf,0x64,0xb3,0xf4,0x65,0xc3,0xb0,0xbd,0xc4,0xf4,0x6f,0x82,0xb9,0x63,0x53,0xf3,0xc0,0x98,0x6e,0xb6,0xfc,0x42,0x48,0x9a,0xc1,0x07,0x38,0xe6,0x6a,0xf1,0x7c,0x18};
    mont256_from_bytes(&ctx, minuend, minuend85);
    mont256_from_bytes(&ctx, subtrahend, subtrahend85);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference85, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend86[32]       = {0x31,0xb1,0x89,0x1a,0x05,0x93,0xdb,0xa2,0x0e,0x28,0xb6,0x4f,0x4e,0xb1,0x9f,0xca,0xa6,0x4f,0x76,0x13,0xb4,0x64,0x2e,0xa4,0x69,0x6c,0x63,0xd6,0xf5,0xea,0xd0,0x65};
    std::uint8_t subtrahend86[32]    = {0x3a,0x53,0xc1,0x76,0x41,0xdb,0x89,0x8e,0x14,0xc2,0x73,0x2a,0x6b,0x86,0x29,0x0b,0xa5,0xac,0xd3,0x41,0xac,0xa9,0x9f,0xd0,0xe2,0x85,0x6e,0xc6,0x7f,0x91,0x42,0x86};
    std::uint8_t difference86[32]    = {0xf7,0x5d,0xc7,0xa2,0xc3,0xb8,0x52,0x13,0xf9,0x66,0x43,0x24,0xe3,0x2b,0x76,0xbf,0x00,0xa2,0xa2,0xd1,0x07,0xba,0x8e,0xd4,0x86,0xe6,0xf5,0x10,0x76,0x59,0x8d,0xde};
    mont256_from_bytes(&ctx, minuend, minuend86);
    mont256_from_bytes(&ctx, subtrahend, subtrahend86);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference86, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend87[32]       = {0xb2,0x21,0x71,0x39,0x08,0xba,0x9b,0xd9,0x7e,0x31,0x8a,0xd6,0x3a,0x0e,0xa6,0xe1,0x5e,0xc6,0x9b,0xe3,0xec,0xd7,0x57,0x0b,0x6c,0xa0,0x64,0x96,0xaa,0xd7,0xc7,0xc0};
    std::uint8_t subtrahend87[32]    = {0x01,0xba,0x98,0x5a,0x32,0xb5,0x58,0xfd,0x65,0x77,0xbb,0x54,0xae,0xbc,0xb0,0xaa,0x5c,0xc0,0xff,0x06,0x6b,0xa9,0x9d,0x01,0xb7,0xe4,0x9f,0x36,0x56,0x8a,0x8c,0x29};
    std::uint8_t difference87[32]    = {0xb0,0x66,0xd8,0xde,0xd6,0x05,0x42,0xdc,0x18,0xb9,0xcf,0x81,0x8b,0x51,0xf6,0x37,0x02,0x05,0x9c,0xdd,0x81,0x2d,0xba,0x09,0xb4,0xbb,0xc5,0x60,0x54,0x4d,0x3b,0x97};
    mont256_from_bytes(&ctx, minuend, minuend87);
    mont256_from_bytes(&ctx, subtrahend, subtrahend87);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference87, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend88[32]       = {0x7e,0xe5,0xe8,0x57,0x34,0x89,0x34,0x98,0x11,0x43,0x40,0xff,0x81,0x3f,0xb5,0xcd,0xd8,0x5b,0xbb,0x6b,0xbd,0x37,0x92,0x9d,0x4a,0xc7,0xcc,0xc3,0xcc,0x0c,0x66,0x82};
    std::uint8_t subtrahend88[32]    = {0x77,0x11,0xb7,0x57,0x3b,0x16,0x49,0x43,0x31,0xa5,0x9c,0x4a,0xd1,0xeb,0xd0,0x86,0xc4,0x0f,0x36,0x09,0x4f,0xcc,0x9a,0x5c,0x33,0x4e,0x51,0xaf,0xf8,0x48,0xa9,0x56};
    std::uint8_t difference88[32]    = {0x07,0xd4,0x30,0xff,0xf9,0x72,0xeb,0x54,0xdf,0x9d,0xa4,0xb4,0xaf,0x53,0xe5,0x47,0x14,0x4c,0x85,0x62,0x6d,0x6a,0xf8,0x41,0x17,0x79,0x7b,0x13,0xd3,0xc3,0xbd,0x2c};
    mont256_from_bytes(&ctx, minuend, minuend88);
    mont256_from_bytes(&ctx, subtrahend, subtrahend88);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference88, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend89[32]       = {0x9f,0xa4,0x0d,0xd6,0xf3,0xb1,0x7a,0xf0,0x1b,0xe7,0xf3,0xcf,0x4b,0x80,0xb8,0x28,0xe3,0xab,0x62,0x83,0xc2,0xae,0x35,0xd2,0x43,0xd8,0x7a,0x97,0x38,0xb0,0x79,0xe1};
    std::uint8_t subtrahend89[32]    = {0xe9,0x0f,0xb6,0x51,0x6a,0xc2,0x6a,0xe0,0x7c,0x2c,0x6a,0x87,0x39,0x2b,0xc5,0x52,0xe5,0x7f,0x76,0x91,0x2f,0xf3,0xc2,0x3c,0x9c,0x2f,0x67,0x23,0x7e,0xea,0x6f,0xe1};
    std::uint8_t difference89[32]    = {0xb6,0x94,0x57,0x84,0x88,0xef,0x10,0x0f,0x9f,0xbb,0x89,0x48,0x12,0x54,0xf2,0xd5,0xfe,0x2b,0xeb,0xf1,0x92,0xba,0x73,0x96,0xa7,0xa9,0x13,0x73,0xb9,0xc6,0x09,0xff};
    mont256_from_bytes(&ctx, minuend, minuend89);
    mont256_from_bytes(&ctx, subtrahend, subtrahend89);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference89, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend90[32]       = {0x0d,0xea,0x6e,0x4e,0x64,0xb9,0xcb,0x1c,0xec,0x03,0x2e,0x6b,0x25,0x79,0x5c,0x18,0x98,0x44,0xf4,0x76,0xf2,0xe2,0x05,0x4d,0x0e,0x71,0x59,0x7a,0xaa,0x50,0xb9,0x6f};
    std::uint8_t subtrahend90[32]    = {0xb5,0xb9,0x4a,0xf3,0x0d,0x45,0x6b,0xe0,0x6a,0x56,0xaa,0xc3,0x24,0x54,0x48,0xc8,0x98,0x9b,0xc9,0xdc,0xf9,0x5f,0xe8,0xa0,0x06,0x0c,0x88,0x04,0x36,0x83,0xd4,0xbc};
    std::uint8_t difference90[32]    = {0x58,0x31,0x23,0x5a,0x57,0x74,0x5f,0x3c,0x81,0xac,0x83,0xa8,0x01,0x25,0x13,0x4f,0xff,0xa9,0x2a,0x98,0xf9,0x82,0x1c,0xae,0x08,0x64,0xd1,0x76,0x73,0xcc,0xe4,0xb2};
    mont256_from_bytes(&ctx, minuend, minuend90);
    mont256_from_bytes(&ctx, subtrahend, subtrahend90);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference90, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend91[32]       = {0x50,0x6f,0x68,0xac,0xe2,0x32,0x89,0x94,0xb6,0x47,0xe8,0xa8,0xe5,0xee,0x4c,0x91,0x73,0x1b,0xbc,0x41,0x64,0xb0,0xbb,0x14,0x2f,0x21,0x7e,0x72,0x0f,0x65,0x06,0x38};
    std::uint8_t subtrahend91[32]    = {0x30,0xd0,0xa2,0xb8,0x54,0x49,0x40,0xe1,0x2a,0x66,0xf9,0x13,0xee,0x7d,0x0a,0xe2,0x14,0x51,0x03,0xc7,0xff,0x5e,0x1d,0x1f,0x1c,0xfb,0x0a,0x06,0xbb,0x93,0xc8,0xeb};
    std::uint8_t difference91[32]    = {0x1f,0x9e,0xc5,0xf4,0x8d,0xe9,0x48,0xb3,0x8b,0xe0,0xef,0x94,0xf7,0x71,0x41,0xaf,0x5e,0xca,0xb8,0x79,0x65,0x52,0x9d,0xf5,0x12,0x26,0x74,0x6b,0x53,0xd1,0x3d,0x4d};
    mont256_from_bytes(&ctx, minuend, minuend91);
    mont256_from_bytes(&ctx, subtrahend, subtrahend91);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference91, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend92[32]       = {0x4f,0xd3,0xe7,0x58,0x08,0x2a,0x2f,0x4d,0x77,0xb5,0xab,0xcb,0xbf,0x0e,0x11,0xe0,0x86,0x59,0x22,0x43,0xef,0x95,0xee,0xe8,0xa7,0x08,0x28,0xa7,0x2f,0x7d,0xba,0x08};
    std::uint8_t subtrahend92[32]    = {0x71,0x43,0x6e,0x1d,0x54,0xea,0x20,0x61,0xfc,0x27,0xd6,0x83,0x5f,0xb6,0xd6,0x25,0xd6,0xd1,0x06,0xfb,0x60,0xed,0x33,0xa0,0xb9,0xb2,0x53,0xe3,0xaa,0x18,0x13,0x45};
    std::uint8_t difference92[32]    = {0xde,0x90,0x79,0x39,0xb3,0x40,0x0e,0xeb,0x7b,0x8d,0xd5,0x48,0x5f,0x57,0x3b,0xba,0xaf,0x88,0x1b,0x47,0x8e,0xa8,0xbb,0x48,0xed,0x55,0xd4,0xc3,0x85,0x65,0xa6,0xc2};
    mont256_from_bytes(&ctx, minuend, minuend92);
    mont256_from_bytes(&ctx, subtrahend, subtrahend92);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference92, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend93[32]       = {0x6b,0x91,0x1f,0x97,0x59,0xf9,0xbb,0x79,0x14,0xac,0xe1,0xcb,0x47,0xa1,0x64,0xe4,0x14,0x07,0xab,0x33,0x00,0xbc,0x22,0xcb,0x1b,0xe4,0xa5,0xdb,0x2b,0x54,0xaf,0x77};
    std::uint8_t subtrahend93[32]    = {0x61,0x50,0x2d,0xee,0x35,0x18,0x53,0x76,0xc2,0x41,0x0a,0xd1,0xf6,0xda,0x7a,0x63,0x8f,0xa6,0x24,0xf7,0x1f,0xab,0x58,0x84,0xe2,0x9a,0xac,0xea,0xf4,0x9c,0x9e,0xba};
    std::uint8_t difference93[32]    = {0x0a,0x40,0xf1,0xa9,0x24,0xe1,0x68,0x02,0x52,0x6b,0xd6,0xf9,0x50,0xc6,0xea,0x80,0x84,0x61,0x86,0x3b,0xe1,0x10,0xca,0x46,0x39,0x49,0xf8,0xf0,0x36,0xb8,0x10,0xbd};
    mont256_from_bytes(&ctx, minuend, minuend93);
    mont256_from_bytes(&ctx, subtrahend, subtrahend93);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference93, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend94[32]       = {0x16,0x77,0x74,0xef,0x6e,0xb4,0xff,0xf8,0xcd,0xce,0xc4,0x08,0xd2,0x6f,0x1d,0x76,0x4f,0x06,0xe9,0x5a,0xd2,0x52,0xa6,0x17,0xc4,0xcb,0xa0,0x38,0x5b,0x4c,0x0d,0x73};
    std::uint8_t subtrahend94[32]    = {0x72,0x43,0xd4,0x7c,0xeb,0x64,0xc5,0xc4,0x8a,0xa1,0xa5,0x9c,0x5f,0x6a,0x35,0xd9,0x32,0x1a,0x6e,0xc1,0x79,0x34,0xf0,0xb8,0xb4,0x8b,0xb0,0x75,0x0c,0x9c,0x20,0xef};
    std::uint8_t difference94[32]    = {0xa4,0x33,0xa0,0x71,0x83,0x50,0x3a,0x34,0x43,0x2d,0x1e,0x6c,0x73,0x04,0xe7,0x9d,0x1c,0xec,0x7a,0x98,0x59,0x1d,0xb5,0x60,0x10,0x3f,0xef,0xc3,0x4e,0xaf,0xec,0x83};
    mont256_from_bytes(&ctx, minuend, minuend94);
    mont256_from_bytes(&ctx, subtrahend, subtrahend94);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference94, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend95[32]       = {0xa1,0xb4,0x9b,0xf7,0x07,0xc0,0x90,0x9c,0x79,0x7b,0x15,0x38,0xe5,0xa1,0x5b,0x79,0xbc,0xc0,0xfd,0x98,0x5d,0x3f,0x69,0xce,0x52,0xc4,0x64,0x1b,0x31,0x6a,0x2a,0x12};
    std::uint8_t subtrahend95[32]    = {0x60,0x25,0x33,0xdc,0x0a,0x68,0x01,0x3d,0x67,0x9f,0x2d,0x9e,0xc4,0x44,0x5a,0xae,0xa0,0x1a,0xc2,0x3a,0xcf,0xd3,0xbb,0x74,0x3f,0x7d,0xc8,0x6b,0x69,0x2a,0x4f,0x0e};
    std::uint8_t difference95[32]    = {0x41,0x8f,0x68,0x1a,0xfd,0x58,0x8f,0x5f,0x11,0xdb,0xe7,0x9a,0x21,0x5d,0x00,0xcb,0x1c,0xa6,0x3b,0x5d,0x8d,0x6b,0xae,0x5a,0x13,0x46,0x9b,0xaf,0xc8,0x3f,0xdb,0x04};
    mont256_from_bytes(&ctx, minuend, minuend95);
    mont256_from_bytes(&ctx, subtrahend, subtrahend95);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference95, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend96[32]       = {0x31,0xe7,0xae,0xd1,0x41,0xcb,0xcc,0x3a,0x0f,0xdf,0x7c,0xc6,0xeb,0x8a,0x25,0xfc,0xcd,0xa7,0x90,0x77,0x10,0x05,0x3d,0x2c,0x76,0xcc,0x05,0x73,0x08,0xec,0x37,0x9a};
    std::uint8_t subtrahend96[32]    = {0x55,0xc0,0xa7,0x4d,0x45,0xb6,0x69,0xf7,0x5c,0xeb,0xe2,0x13,0x56,0xcd,0x42,0xd2,0x9b,0x09,0xab,0x55,0xe6,0x07,0x7d,0x79,0x10,0x17,0x0d,0x2b,0xbf,0x4e,0x30,0x2c};
    std::uint8_t difference96[32]    = {0xdc,0x27,0x07,0x82,0xfc,0x15,0x62,0x42,0xb2,0xf3,0x9a,0xb3,0x94,0xbc,0xe3,0x2a,0x32,0x9d,0xe5,0x20,0x29,0xfd,0xbf,0xb4,0x66,0xb4,0xf8,0x47,0x49,0x9e,0x07,0x6d};
    mont256_from_bytes(&ctx, minuend, minuend96);
    mont256_from_bytes(&ctx, subtrahend, subtrahend96);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference96, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend97[32]       = {0xb0,0x88,0x24,0x11,0xb7,0x75,0x70,0xa4,0xbf,0x16,0x8d,0xa7,0x43,0x1d,0xbc,0x3f,0x0b,0x28,0x6c,0x70,0x9d,0xf2,0x4d,0x5e,0xf4,0x29,0xc6,0x22,0xf5,0x2b,0x25,0x49};
    std::uint8_t subtrahend97[32]    = {0x98,0x77,0x27,0x90,0xc1,0x72,0x6f,0x06,0xb8,0xb8,0xf2,0x70,0x00,0xf7,0x2d,0x3c,0x4c,0x22,0xca,0xb7,0x46,0x8f,0xb5,0x96,0xec,0x9a,0x36,0x0c,0x51,0x05,0x12,0x2a};
    std::uint8_t difference97[32]    = {0x18,0x10,0xfc,0x80,0xf6,0x03,0x01,0x9e,0x06,0x5d,0x9b,0x37,0x42,0x26,0x8f,0x02,0xbf,0x05,0xa1,0xb9,0x57,0x62,0x97,0xc8,0x07,0x8f,0x90,0x16,0xa4,0x26,0x13,0x1f};
    mont256_from_bytes(&ctx, minuend, minuend97);
    mont256_from_bytes(&ctx, subtrahend, subtrahend97);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference97, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend98[32]       = {0xd3,0x75,0xef,0xf1,0x06,0x35,0xaf,0xef,0x10,0xb9,0x9a,0xc9,0xf1,0x78,0xd7,0x7f,0xf2,0x4d,0x04,0xfd,0xa2,0x4c,0x84,0x07,0xce,0x3f,0xa0,0x28,0xea,0x9d,0x18,0xb2};
    std::uint8_t subtrahend98[32]    = {0xc6,0xbf,0x4f,0xa2,0xf4,0x33,0x7b,0xd1,0x77,0x3a,0xfe,0x02,0xf4,0xef,0x61,0x42,0xb7,0x2f,0xac,0x4a,0x79,0xa5,0xfd,0x62,0x1b,0x75,0x7b,0x20,0x3b,0xde,0xa8,0xc3};
    std::uint8_t difference98[32]    = {0x0c,0xb6,0xa0,0x4e,0x12,0x02,0x34,0x1d,0x99,0x7e,0x9c,0xc6,0xfc,0x89,0x76,0x3d,0x3b,0x1d,0x58,0xb3,0x28,0xa6,0x86,0xa5,0xb2,0xca,0x25,0x08,0xae,0xbe,0x6f,0xef};
    mont256_from_bytes(&ctx, minuend, minuend98);
    mont256_from_bytes(&ctx, subtrahend, subtrahend98);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference98, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
    std::uint8_t minuend99[32]       = {0x21,0xf9,0x1a,0x99,0x7e,0x54,0x4d,0x56,0xd0,0x96,0xbf,0xd6,0x6e,0x10,0x6c,0x0e,0xe9,0xde,0x04,0x79,0x40,0x44,0x9a,0xa0,0xca,0x30,0x42,0x18,0x62,0xf2,0xa2,0x1b};
    std::uint8_t subtrahend99[32]    = {0x4d,0xa6,0x09,0x90,0xbd,0x0d,0x8c,0xfe,0xee,0x59,0xb3,0x97,0xcd,0x75,0x1e,0x08,0x02,0x3a,0x80,0xa2,0x2e,0xd5,0x1b,0x12,0x7f,0x1d,0x49,0x0e,0xed,0x97,0xec,0x76};
    std::uint8_t difference99[32]    = {0xd4,0x53,0x11,0x07,0xc1,0x46,0xc0,0x57,0xe2,0x3d,0x0c,0x3e,0xa0,0x9b,0x4e,0x06,0xe7,0xa3,0x83,0xd6,0x11,0x6f,0x7f,0x8f,0x4b,0x12,0xf9,0x09,0x75,0x5a,0xb5,0xa4};
    mont256_from_bytes(&ctx, minuend, minuend99);
    mont256_from_bytes(&ctx, subtrahend, subtrahend99);
    mont256_sub(&ctx, difference, minuend, subtrahend);
    mont256_to_bytes(&ctx, difference_data, difference);
    if (std::memcmp(difference99, difference_data, 32) != 0)
    {
        throw std::runtime_error("err in mont256_sub");
    }
}
